(maint) Merge up 95e7bdd to main

Generated by CI

* commit '95e7bdd8c80577910aa205a9ff4d9728994cb240':
  (PUP-11402) change test check against stderr instead stdout
  (PUP-11330) Puppet::Node#environment_name may return the wrong value
  (packaging) Updating manpage file for 6.x
  (packaging) Updating the puppet.pot file
  (PUP-11402) Puppet lookup fails when used localy

Author: puppetlabs-jenkins

acceptance/tests/parser_functions/puppet_lookup_cmd.rb

@@ -2193,16 +2193,6 @@ def data()
 step 'start puppet server'
 with_puppet_running_on master, @master_opts, @coderoot do
 
-  step "handle certificate"
-  on(master, "puppetserver ca generate --certname #{@node1}")
-  on(master, "puppetserver ca generate --certname #{@node2}")
-  on(master, "mkdir -p #{@testroot}/puppet/ssl/certs")
-  on(master, "mkdir -p #{@testroot}/puppet/ssl/private_keys")
-  on(master, "cp -a /etc/puppetlabs/puppet/ssl/certs/ca.pem #{@testroot}/puppet/ssl/certs")
-  on(master, "cp -a /etc/puppetlabs/puppet/ssl/crl.pem #{@testroot}/puppet/ssl")
-  on(master, "cp -a /etc/puppetlabs/puppet/ssl/private_keys/#{master.connection.hostname}.pem #{@testroot}/puppet/ssl/private_keys")
-  on(master, "cp -a /etc/puppetlabs/puppet/ssl/certs/#{master.connection.hostname}.pem #{@testroot}/puppet/ssl/certs")
-
   step "global_key"
   rg = on(master, puppet('lookup', 'global_key'))
   result = rg.stdout
@@ -2587,6 +2577,25 @@ def data()
   step 'apply enc manifest'
   apply_manifest_on(master, @encmanifest, :catch_failures => true)
 
+  step "--compile uses environment specified in ENC"
+  r = on(master, puppet('lookup', '--compile', "--node #{@node1}", "--confdir #{@confdir}", "--facts #{@coderoot}/facts.yaml", 'environment_key'))
+  result = r.stderr
+  assert_match(
+    /CA is not available/,
+    result,
+    "lookup in ENC specified environment failed"
+  )
+
+  step "handle certificate"
+  on(master, "puppetserver ca generate --certname #{@node1}")
+  on(master, "puppetserver ca generate --certname #{@node2}")
+  on(master, "mkdir -p #{@testroot}/puppet/ssl/certs")
+  on(master, "mkdir -p #{@testroot}/puppet/ssl/private_keys")
+  on(master, "cp -a /etc/puppetlabs/puppet/ssl/certs/ca.pem #{@testroot}/puppet/ssl/certs")
+  on(master, "cp -a /etc/puppetlabs/puppet/ssl/crl.pem #{@testroot}/puppet/ssl")
+  on(master, "cp -a /etc/puppetlabs/puppet/ssl/private_keys/#{master.connection.hostname}.pem #{@testroot}/puppet/ssl/private_keys")
+  on(master, "cp -a /etc/puppetlabs/puppet/ssl/certs/#{master.connection.hostname}.pem #{@testroot}/puppet/ssl/certs")
+
   step "--compile uses environment specified in ENC"
   r = on(master, puppet('lookup', '--compile', "--node #{@node1}", "--confdir #{@confdir}", "--facts #{@coderoot}/facts.yaml", 'environment_key'))
   result = r.stdout

lib/puppet/application/lookup.rb

@@ -379,25 +379,31 @@ def generate_scope
       else
         ni = Puppet::Node.indirection
         tc = ni.terminus_class
-
-        service = Puppet.runtime[:http]
-        session = service.create_session
-        cert = session.route_to(:ca)
-
-        _, x509 = cert.get_certificate(node)
-        cert = OpenSSL::X509::Certificate.new(x509)
-
-        Puppet::SSL::Oids.register_puppet_oids
-        trusted = Puppet::Context::TrustedInformation.remote(true, facts.values['certname'] || node, Puppet::SSL::Certificate.from_instance(cert))
-
-        Puppet.override(trusted_information: trusted) do
-          if tc == :plain || options[:compile]
+        if options[:compile]
+          if tc == :plain
             node = ni.find(node, facts: facts)
           else
-            ni.terminus_class = :plain
-            node = ni.find(node, facts: facts)
-            ni.terminus_class = tc
+            begin
+              service = Puppet.runtime[:http]
+              session = service.create_session
+              cert = session.route_to(:ca)
+
+              _, x509 = cert.get_certificate(node)
+              cert = OpenSSL::X509::Certificate.new(x509)
+              Puppet::SSL::Oids.register_puppet_oids
+              trusted = Puppet::Context::TrustedInformation.remote(true, facts.values['certname'] || node, Puppet::SSL::Certificate.from_instance(cert))
+              Puppet.override(trusted_information: trusted) do
+                node = ni.find(node, facts: facts)
+              end
+            rescue
+              Puppet.warning _("CA is not available, the operation will continue without using trusted facts.")
+              node = ni.find(node, facts: facts)
+            end
           end
+        else
+          ni.terminus_class = :plain
+          node = ni.find(node, facts: facts)
+          ni.terminus_class = tc
         end
       end
     else

lib/puppet/configurer.rb

@@ -601,17 +601,7 @@ def current_server_specified_environment(current_environment, configured_environ
                                              :transaction_uuid => @transaction_uuid,
                                              :fail_on_404 => true)
 
-        # The :rest node terminus returns a node with an environment_name, but not an
-        # environment instance. Attempting to get the environment instance will load
-        # it from disk, which will likely fail. So create a remote environment.
-        #
-        # The :plain node terminus returns a node with an environment, but not an
-        # environment_name.
-        if !node.has_environment_instance? && node.environment_name
-          node.environment = Puppet::Node::Environment.remote(node.environment_name)
-        end
-
-        @server_specified_environment = node.environment.to_s
+        @server_specified_environment = node.environment_name.to_s
 
         if @server_specified_environment != @environment
           Puppet.notice _("Local environment: '%{local_env}' doesn't match server specified node environment '%{node_env}', switching agent to '%{node_env}'.") % { local_env: @environment, node_env: @server_specified_environment }

lib/puppet/node.rb

@@ -89,7 +89,7 @@ def environment=(env)
     unless @environment.nil?
       # always set the environment parameter. It becomes top scope $environment for a manifest during catalog compilation.
       @parameters[ENVIRONMENT] = @environment.name.to_s
-      self.environment_name = @environment.name if instance_variable_defined?(:@environment_name)
+      self.environment_name = @environment.name
     end
     @environment
   end

spec/integration/application/lookup_spec.rb

@@ -48,6 +48,7 @@
     let(:facts) { Puppet::Node::Facts.new("facts", {'my_fact' => 'my_fact_value'}) }
     let(:cert) { pem_content('oid.pem') }
 
+    let(:node) { Puppet::Node.new('testnode', :facts => facts, :environment => env) }
     let(:populated_env_dir) do
       dir_contained_in(env_dir, environment_files)
       env_dir
@@ -104,7 +105,9 @@ def explain(key, options = {})
         certname: fqdn,
         extensions: { "1.3.6.1.4.1.34380.1.2.1.1" => "somevalue" }))
 
-      lookup('a')
+      Puppet.settings[:node_terminus] = 'exec'
+      expect_any_instance_of(Puppet::Node::Exec).to receive(:find).and_return(node)
+      lookup('a', :compile => true)
     end
 
     it 'loads external facts when running without --node' do

spec/unit/node_spec.rb

@@ -40,6 +40,12 @@
         expect(node.environment.name).to eq(:bar)
       end
 
+      it "sets environment_name with the correct environment name" do
+        node = Puppet::Node.new("foo")
+        node.environment = Puppet::Node::Environment.remote('www123')
+        expect(node.environment_name).to eq(:www123)
+      end
+
       it "allows its environment to be set by parameters after initialization" do
         node = Puppet::Node.new("foo")
         node.parameters["environment"] = :bar