PE known issues
These are the known issues in PE 2021.3.
Installation and upgrade known issues
These are the known issues for installation and upgrade in this release.
Continuous Delivery for Puppet Enterprise users must upgrade prior to installing this version of PE
CD4PE customers must upgrade to version 4.8.2 before installing PE version 2021.3. This is due to a PuppetDB issue causing the generation of new fact charts on the Nodes page in CD4PE to fail. See Upgrading Continuous Delivery for PE for information about upgrading.
Initial agent run after upgrade can fail with many environments
In installations with many environments, where file sync can take several minutes, the orchestration service fails to reload during the first post-upgrade Puppet run. As a workaround, re-run the Puppet agent until the orchestration service loads properly. To prevent encountering this error, you can clean up unused environments before upgrading, and wait several minutes after the installer completes to run the agent.
Installing or upgrading agents using TLSv1 fails with older OpenSSL versions
Script-based agent installation or upgrade on nodes that use TLSv1 can fail if the
curl version installed on the node uses OpenSSL earlier than version 1.0. This issue
produces an SSL error during any curl connection to the primary server. As a
--ciphers AES256-SHA to
~/.curlrc so that curl calls always use an appropriate
Windows agent installation fails given a space in user name
The Windows agent install script fails if executed
with a user name that includes a space, like
Spacey. You receive the error Something went wrong with the
installation along with exit code 1639. As a workaround, run the install
script on Windows agents with a username without
spaces, or use an alternative installation method, such as the
Converting legacy compilers fails with an external certificate authority
puppet infrastructure run convert_legacy_compilercommand fails with an error during the certificate-signing step.
Agent_cert_regen: ERROR: Failed to regenerate agent certificate on node <compiler-node.domain.com> Agent_cert_regen: bolt/run-failure:Plan aborted: run_task 'enterprise_tasks::sign' failed on 1 target Agent_cert_regen: puppetlabs.sign/sign-cert-failed Could not sign request for host with certname <compiler-node.domain.com> using caserver <master-host.domain.com>
- Log on to the CA server and manually sign certificates for the compiler.
- On the compiler, run Puppet:
puppet agent -t
- Unpin the compiler from PE Master group, either from
the console, or from the CLI using the command:
/opt/puppetlabs/bin/puppet resource pe_node_group "PE Master" unpinned="<COMPILER_FQDN>"
- On your primary server, in the
pe.conffile, remove the entry
- If you have an external PE-PostgreSQL node, run Puppet on that node:
puppet agent -t
- Run Puppet on your primary server:
puppet agent -t
- Run Puppet on all compilers:
puppet agent -t
Converted compilers can slow PuppetDB in multi-region installations
In configurations that rely on high-latency connections between your primary servers and compilers – for example, in multi-region installations – converted compilers running the PuppetDB service might experience significant slowdowns. If your primary server and compilers are distributed among multiple data centers connected by high-latency links or congested network segments, reach out to Support for guidance before converting legacy compilers.
Disaster recovery known issues
These are the known issues for disaster recovery in this release.
An unreachable replica runs the primary server out of disk space
If a provisioned replica becomes unreachable, the associated primary server can quickly run out of disk space, causing a complete interruption to PE services. In larger installations, an outage can occur in under an hour. The disk usage issue is caused by the PE-PostgreSQL service on the primary server retaining change logs that the replica hasn't acknowledged.
puppet infrastructure forget <REPLICA NODE NAME>.
FIPS known issues
These are the known issues with FIPS-enabled PE in this release.
Puppet Server FIPS installations don’t support Ruby’s OpenSSL module
FIPS-enabled PE installations don't support extensions
or modules that use the standard Ruby Open SSL
library, such as hiera-eyaml or the
module. As a workaround, you can use a non-FIPS-enabled primary server with
FIPS-enabled agents, which limits the issue to situations where only the agent uses
the Ruby library.
Errors when using
puppet code and
puppet db commands on FIPS-compliant platforms
pe-client-toolspackages are run on FIPS-compliant platforms,
puppet dbcommands fail with SSL handshake errors. To use
puppet dbcommands on a FIPS-compliant platforms, install the puppetdb_cli Ruby gem with the following command:
/opt/puppetlabs/puppet/bin/gem install puppetdb_cli --bindir /opt/puppetlabs/bin/
puppet codecommands on a FIPS-compliant platforms, use the Code Manager API. Alternatively, you can use
pe-client-toolson a non-FIPS-compliant platform to access a FIPS-enabled primary server.
Configuration and maintenance known issues
These are the known issues for configuration and maintenance in this release.
Restarting or running Puppet on infrastructure nodes can trigger an illegal reflective access operation warning
When restarting PE services or performing agent runs on infrastructure nodes, you might see the warning Illegal reflective access operation ... All illegal access operations will be denied in a future release in the command-line output or logs. These warnings are internal to PE service components, have no impact on their functionality, and can be safely disregarded.
Orchestration services known issues
These are the known issues for the orchestration services in this release.
Running plans during code deployment can result in failures
If a plan is running during a code deployment, things like compiling apply block statements or downloading and running tasks that are part of a plan might fail. This is because plans run on a combination of PE services, like orchestrator and puppetserver, and the code each service is acting on might get temporarily out of sync during a code deployment.
puppet plan subcommand segfaults
When run without arguments, the
puppet plan subcommand
Console and console services known issues
These are the known issues for the console and console services in this release.
Gateway timeout errors in the console
Using facts to filter nodes might produce either a "502 Bad Gateway" or "Gateway Timeout" error instead of the expected results.
SSO login fails if no email address is specified
When logging in to the console via SSO, if no email address is specified in the IdP, the login fails.
Patching known issues
These are the known issues for patching in this release.
Patching fails with excluded yum packages
In the patching task or plan, using
--exclude flag in order to exclude certain
packages can result in task or plan failure if the only packages requiring updates
are excluded. As a workaround, use the
command (which requires installing the yum-plugin-versionlock package) to lock the
packages you want to exclude at their current version. Alternatively, you can fix a
package at a particular version by specifying the version with a package resource
for a manifest that applies to the nodes to be patched.
Failed or in-progress reboots are incorrectly reporting that they finished rebooting successfully
When rebooting a node using the
pe_patch::group_patching plan, the check to detect if a node has
rebooted always detects that it finished rebooting successfully, even if the reboot
failed or is still in progress, due to a parsing error in the output. This behavior
has been observed and tested on RHEL-based platform
versions 6 and 7, and SLES version 12, but it might exist on other platforms as
Code management known issues
These are the known issues for Code Manager, r10k, and file sync in this release.
r10k deletes files in environments pointed to by symlinks
When control repositories contain symlinks, r10k incorrectly interprets the files in symlinked locations as duplicates and deletes these files. If you use Code Manager and include symlinks in your control repository, do not upgrade to PE version 2021.3. This issue will be resolved in an upcoming release.
Changing a file type in a control repo produces a checkout conflict error
Changing a file type in a control repository – for example, deleting a file and replacing it with a directory of the same name – generates the error JGitInternalException: Checkout conflict with files accompanied by a stack trace in the Puppet Server log. As a workaround, deploy the control repo with the original file deleted, and then deploy again with the replacement file or directory.
Enabling Code Manager and multithreading in Puppet Server deadlocks JRuby
Setting the new
parameter to any non-zero value – including the
unlimited default when Code Manager is enabled – interferes
with multithreading in Puppet Server and
can result in JRuby deadlocking after
Code Manager and r10k do not identify the default branch for module repositories
When you use Code Manager or r10k to deploy modules from a Git
source, the default branch of the source repository is always
assumed to be main. If the module repository uses a default branch
that is not main, an error occurs. To work around this issue,
specify the default branch with the
ref: key in
environmentdir to be a
relative path causes deploy failures
When deploying modules from a Puppetfile
using r10k or Code Manager, the deploy
fails if your
configured to be a relative path instead of an absolute path
puppet code tool outputs
informational data to
A regression in the
puppet code tool
causes Code Manager to output information
stderr, whether it's successful
or not. This might be inconvenient if deploys are done through
pipelines that are configured to register failures based on
stderr output because the behavior
puppet code will always lead to a