Before 6.4, the agent would rescue all StandardErrors during key generation, csr submission, cert retrieval, and wait for waitforcert seconds until retrying. In 6.4.0, only rescues some errors, which is a bug.
In previous versions of puppet, I would spin up instances in AWS, regardless of the puppetservere being available, and have runinterval at 20 seconds. Whenever the base packages were installed, I'd update the puppet configuration to a runinterval of every 30 minutes.
Since I've started version 6 clients, this "trick" no longer works. The puppet client will try to connect to the puppetserver when it starts, and if it doesn't it will exit. That's quite disastrous for my deployment strategy.
Steps to reproduce:
Pre-requisites: Have the above puppet server and client versions on a single machine. Have puppetserver and client stopped.
1. Start puppet client.
*Desired Behavior:*
A. puppet client starts, regardless of a connection is possible with the puppetserver. It will re-try each runinterval.
*Actual Behavior:* - puppet client exits with below message in /var/log/messagemessages: {noformat} May 22 15:08:05 bas-t-1 systemd: Started Puppet agent. May 22 15:08:07 bas-t-1 puppet-agent[12580]: Could not run: Failed to open TCP connection to bas-t-1.t.dam.loc:8140 (Connection refused - connect(2) for "bas-t-1.t.dam.loc" port 8140) May 22 15:08:07 bas-t-1 systemd: puppet.service: main process exited, code=exited, status=1/FAILURE May 22 15:08:07 bas-t-1 systemd: Unit puppet.service entered failed state. May 22 15:08:07 bas-t-1 systemd: puppet.service failed.{noformat} puppet.conf: {noformat} [main] server = bas-t-1.t.dam.loc environment = production runinterval = 20s hiera_config = /etc/puppetlabs/puppet/hiera.yaml [master] dns_alt_names = bas-t-1.t.dam.loc{noformat}
Restores the behavior present in < 6.4 whereby non-onetime puppet runs will wait and retry if an error is encountered while bootstrapping the SSL subsystem. The wait interval is controlled by the existing `waitforcert` setting. Onetime puppet runs (such as `puppet agent --test/--onetime`) will not retry, and instead exit when the first error occurs.