PE known issues

Converting legacy compilers fails with an external certificate authority

Agent_cert_regen: ERROR: Failed to regenerate agent certificate on node <compiler-node.domain.com>
Agent_cert_regen: bolt/run-failure:Plan aborted: run_task 'enterprise_tasks::sign' failed on 1 target
Agent_cert_regen: puppetlabs.sign/sign-cert-failed Could not sign request for host with certname <compiler-node.domain.com> using caserver <master-host.domain.com>

Converted compilers can slow PuppetDB in multi-region installations

In configurations that rely on high-latency connections between your primary servers and compilers – for example, in multi-region installations – converted compilers running the PuppetDB service might experience significant slowdowns. If your primary server and compilers are distributed among multiple data centers connected by high-latency links or congested network segments, reach out to Support for guidance before converting legacy compilers.

Puppet Enterprise HA upgrade fails on main for Amazon Linux 2 primary server

The puppet infra upgrade replica command may fail with errors downloading pe-postgres packages when running with a PE replica on Amazon Linux 2. Users can run the same command a second time in this case and the second attempt should succeed.

FIPS-enabled PE 2023.0 and later can't use the default system cert store

FIPS-compliant builds running PE 2023.0 and later can't use the default system cert store, which is used automatically with some reporting services. This setting is configured by the report_include_system_store Puppet parameter that ships with PE.

Removing the puppet-cacerts file (located at /opt/puppetlabs/puppet/ssl/puppet-cacerts) can allow a report processor that eagerly loads the system store to continue with a warning that the file is missing.

If HTTP clients require external certs, we recommend using a custom cert store containing only the necessary certs. You can create this cert store by concatenating existing pem files and configuring the ssl_trust_store Puppet parameter to point to the new cert store.

Puppet Server FIPS installations don’t support Ruby’s OpenSSL module

FIPS-enabled PE installations don't support extensions or modules that use the standard Ruby Open SSL library, such as hiera-eyaml. As a workaround, you can use a non-FIPS-enabled primary server with FIPS-enabled agents, which limits the issue to situations where only the primary uses the Ruby library. This limitation does not apply to versions 1.1.0 and later of the splunk_hec module, which supports FIPS-enabled servers. The FIPS Mode section of the module's Forge page explains the limitations of running this module in a FIPS environment.

puppet infrastructure tune fails with multi-environment environmentpath

The puppet infrastructure tune command fails if environmentpath (in your puppet.conf file) is set to multiple environments. To avoid the failure, comment out this setting before running this command. For details about the environmentpath setting, refer to environmentpath in the open source Puppet documentation.

Restarting or running Puppet on infrastructure nodes can trigger an illegal reflective access operation warning

When restarting PE services or performing agent runs on infrastructure nodes, you might see this warning in the command-line output or logs: Illegal reflective access operation ... All illegal access operations will be denied in a future release

These warnings are internal to PE service components and have no impact on their functionality. You can safely disregard them.

JRuby instance flushing may cause a memory leak

JRuby instance flushing may cause a memory leak for many, if not all, of our users. We recommend that users who have set their max-requests-per-instance settings for JRuby pools to custom, non-zero values to either move them to be unmanaged i.e. accept the default value or explicitly set the default value to 0 (the new default). Please do not manually flush the JRuby pool via the HTTP API.

Patching fails with excluded YUM packages

In the patching task or plan, using yum_params to pass the --exclude flag in order to exclude certain packages can result in task or plan failure if the only packages requiring updates are excluded. As a workaround, use the versionlock command (which requires installing the yum-plugin-versionlock package) to lock the packages you want to exclude at their current version. Alternatively, you can fix a package at a particular version by specifying the version with a package resource for a manifest that applies to the nodes to be patched.

Advanced Patching: Nodes persist in vulnerability information after being removed from PE

In PE 2025.2.0, the list of nodes affected by a specific vulnerability may include nodes that have been removed from Puppet Enterprise. If you select a node for vulnerability remediation and that node is no longer managed by PE, page loading fails with an error stating that no information is known about the node. To check whether a node is absent from the PE inventory, click Status or NodesNodes in the console and search for the node.

Advanced Patching: Node count on the patch group page fails to account for rules matches

In PE 2025.2.0, with the introduction of the rules to the patch group API, the counts of nodes on the patch group page do not correctly reflect the number of nodes in the group. The count is typically determined from looking at the total resolved nodes.

Advanced Patching: Counts on overview fails to account for rules matches

In PE 2025.2.0, the overview counts of security items in patch groups does not take into account nodes that result from the dynamic rules for a patch group.

Changing a file type in a control repo produces a checkout conflict error

Changing a file type in a control repository – for example, deleting a file and replacing it with a directory of the same name – generates the error JGitInternalException: Checkout conflict with files accompanied by a stack trace in the Puppet Server log. As a workaround, deploy the control repo with the original file deleted, and then deploy again with the replacement file or directory.

Code deployment fails from AzureDevOps with a rsa-sha error in Puppet Enterprise®

Deploying code via r10k or Code Manager from Azure DevOps (ADO) with a rsa-sha2 key fails with a deprecated rsa-sha error. To fix the issue, change your authentication method to HTTPS and complete the steps outlined here: Knowledge base article.