Puppet Server release notes
Puppet Server 7.4.1
Release October 2021 and shipped with Puppet 7.12.0.
Retrieve facts from any terminus. The v4 catalog endpoint (used by Impact Analysis) now supports retrieving facts from any facts terminus, if none are provided with the request. PUP-11256
Puppet Server 7.4.0
Release September 2021 and shipped with Puppet 7.11.0.
TLS 1.3 support. Puppet Server now supports TLS 1.3 and associated cipher suites by default. SERVER-3076
Improved performance in
list command. Puppetserver CA CLI command
list utilizes the updated
certificate_status endpoint for a faster performance when listing certificate requests. SERVER-3060
--force flag in certificate generation. The
puppetserver ca generate --ca-client command can now take a
--force flag, which forces the tool to generate the certificate even if it cannot determine whether Puppet Server is offline. To avoid CA corruption, ensure your server is offline before you use this flag. SERVER-2842
Puppet Server 7.3.0
Release August 2021 and shipped with Puppet 7.10.0.
Prune duplicate entries from CRL. In this release, the
puppetserver ca subcommand now accepts the
prune actions. These actions allow you to prune any duplicate certificates from Puppet’s CRL. SERVER-2740
CRL query speed. Querying CRLs from
puppetserver is now faster, resulting in fewer timeouts. SERVER-3020
Scripts as a default mount. Puppet Server has a new default mount named
scripts. You can use the new default mount with API endpoints such as
static_file_content to load scripts from the
scripts/ directory of a module. SERVER-3058
Duplicate entries in CRL. Puppet CA no longer allows adding duplicate certificates to the CRL. SERVER-2509
Puppet Server 7.2.1
Released July 2021 and shipped with Puppet 7.9.0.
Add new flag. In this release, the
puppetserver casubcommand now accepts the
--verboseflag. If the
--verboseflag is passed, it displays additional low-level details about the invoked action (such as details about HTTP requests created by the tool). SERVER-2251
Specify certificate output in JSON. In this release, the
puppetserver ca listaction now accepts a
--formatflag that can be used to display certificates in JSON format. The output format is
textby default. SERVER-3006
Jetty 9.4.42. This release includes a Jetty update to 9.4.42. SERVER-3035
CRL update endpoint is not enabled by default. The
PUT /puppet-ca/v1/certificate_revocation_listendpoint is now enabled by default for clients that have a special cert extension. Previously, you had to manually update the
auth.conffile to access this endpoint. SERVER-3033
Puppet Server cannot use OpenSSL EC files in OpenSSL format. Previously, Puppet Server failed to load private key PEM files that include separate blocks for EC parameters (such as files output by OpenSSL’s EC key gen commands). This issue is now fixed. SERVER-3016
A command errors because of the subject alternative name. The
puppetserver ca generatecommand no longer errors when
allow-subject-alt-namesis set to false. SERVER-3032
Puppet Server 7.2.0
Released May 2021 and shipped with Puppet 7.7.0 and Puppet 7.8.0.
The CA API accepts CRL updates. You can now update your CRLs using the new API endpoint:
PUT /puppet-ca/v1/certificate_revocation_list. This new endpoint accepts a list of CRL PEMs as a body, inserting updated copies of the applicable CRLs into the trust chain. The CA updates the matching CRLs saved on disk if the submitted ones have a higher CRL number than their counterparts. You can use this endpoint if your CRLs require frequent updates. Do not use the endpoint to update the CRL associated with the Puppet CA signing certificate (only earlier ones in the certificate chain). SERVER-2550
JRuby 220.127.116.11. In this release, the JRuby version is updated to 18.104.22.168. SERVER-3007
New apache HTTP client broke URL normalization. A security update to the apache HTTP client introduced an unrelated change to URL normalization. This change affected any use of Puppet’s HTTP client within Puppet Server. In this release, the double slash in a URL path is no longer silently ignored by the HTTP client in Puppet Server. Instead, Puppet Server views it as a different URL and returns a 404. Going forward, remove leading double slashes from URLs. SERVER-3014
Environment endpoint failed to cache data if given valid etag. Previously, if you used the environment and transport info endpoints, then you might have seen the cache bypassed—despite receiving a 304 Not Modified response. To work around this issue, users must submit a request to the
environment_classesendpoint without the etag. This request triggers the correct caching behavior. Note that the console (the consumer of the
environment_classesendpoint in PE) must always submit an etag for an environment if it has one. SERVER-3015
Puppet Server 7.1.2
Released April 2021 and shipped with Puppet 7.6.1.
This release includes minor dependency updates, including an update to Jetty 9.4.40 to resolve security issues.
Puppet Server 7.1.0
Released March 2021 and shipped with Puppet 7.5.0.
Puppet Server adds SAN when signing CSR. Puppet Server now adds an extension for subject-alternative-name (SAN) when it signs incoming certificate signing requests (CSR). The SAN extension contains the common name (CN) as a dns-name on the certificate. If the CSR comes with its own SAN extension, Puppet Server signs it and ensures the SAN extension includes the CSR’s CN. SERVER-2338
Attempts to start a compile master failed with a CRL error. The Jetty webserver now uses the local copy of the CRL from Puppet's SSL directory instead of the CA's copy. This fix makes it easier to set up compilers, which always have a disabled CA service and no CRL at the CA path. SERVER-2558
Puppet Server's updated configuration values. The
master-run-dirconfiguration settings have been deprecated in favor of
server-run-dirrespectively. The configuration files — which use the new settings — are shipped with the 7.1.0
puppetserverpackage. Note that the old settings are still honored for backwards compatibility, but we recommend you upgrade to the new settings. SERVER-2867
Puppet Server 7.0.3
Released February 2021 and shipped with Puppet 7.4.0.
This release updates dependencies to include security fixes.
Puppet Server 7.0.2
Released January 2021 and shipped with Puppet 7.3.0.
Puppet Server failed to issue a warning for the applicable behavior. The warning issued when the CA directory is inside the SSL directory now only prints server logs at startup and when using the
puppetserver caCLI, instead of any time a Puppet command is used. (SERVER-2934)
Puppet Server 7.0.1
Released December 2020 and shipped with Puppet 7.1.0.
JRuby 22.214.171.124. The JRuby version has been bumped from 126.96.36.199 to 188.8.131.52. (SERVER-2925)
Symlink from the previous cadir has the same permissions as the current cadir. When creating the symlink between the new and legacy cadirs the symlink will now be properly owned by the
CA command line tool failed to honor a section in Puppet's configuration file. The CA command line tool now correctly honors the
serversections in the
Puppet Server 7.0.0
Released November 2020 and shipped with Puppet 7.0.0.
Puppet Server 7.0 is a major release. It breaks compatibility with agents prior to 4.0 and the legacy Puppet
auth.conf, moves the default location for the
cadir, and changes defaults for fact caching and cipher suites. See below for more details. Caution is advised when upgrading.
The default value for the
cadirsetting is now located at
/etc/puppetlabs/puppetserver/ca. Previously, the default location was inside Puppet's own
/etc/puppetlabs/puppet/ssl/ca. This change makes it safer to delete Puppet's
ssldirwithout accidentally deleting your CA certificates.
The puppetserver CA CLI now provides a
migratecommand to move the CA directory from the Puppet
confdirto the puppetserver
confdir. It leaves behind a symlink on the old CA location, pointing to the new location at
/etc/puppetlabs/puppetserver/ca. The symlink provides backwards compatibility for tools still expecting the
cadirto exist in the old location. In a future release, the
cadirsetting will be removed entirely. (SERVER-2896)
The default value for the facts cache is now JSON instead of YAML. You can re-enable the old YAML terminus in
Support for legacy Puppet
auth.confhas been removed and the
jruby-puppet.use-legacy-auth-confsetting no longer works. Use Puppet Server's
auth.conffile instead. (SERVER-2778)
Puppet Server no longer services requests for legacy (3.x) Puppet endpoints. Puppet Agents before 4.0 are no longer be able to check in. (SERVER-2791)
This release removes default support for many cipher suites when contacting Puppet Server. The new default supported cipher suites are:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. This change aligns open source Puppet with Puppet Enterprise. Note that this change may break on old platforms. To re-enable older cipher suites you may edit the
webserver.conf. Valid cipher suite names are listed in the JDK Documentation. (SERVER-2913)
Puppet Server now provides an HTTP client whose API conforms to the HTTP client provided by Puppet. This new client is stored in the Puppet runtime as