Puppet 8 Release Announcement

[Puppet Product Updates]

Hello All,

Puppet 8 has been released!  There are new features, resolved issues and deprecations in this version of Puppet.  See release notes for full details.

Enhancements

Freeze string literals 
String literals are now immutable by default.

Strict mode enabled by default

For Puppet 8, strict mode is on by default, meaning strict defaults to error and strict_variables defaults to true. With strict set to error, extra validation & checks are performed and fail as an error. This change could be a breaking change if your code does not conform to strict mode.

Examples of code that does not conform to strict mode:

• Accessing a variable without first defining it: notice($myvar)

• Accessing a legacy fact: notice($facts['osfamily'])

• Coercing a string into a numeric: "1" + 1

To return to the previous behavior, set, strict to warning and strict_variables to false. 

Change default value of exclude_unchanged_resources 

Puppet reports no longer contain detailed information about resources already matching their desired state. Doing so reduces the amount of data stored in PuppetDB in the most common case when nothing has changed. The previous behavior can be enabled by setting exclude_unchanged_resources=false in puppet.conf on each agent. 

Drop Hiera 3 Requirement 

Hiera 3 is no longer a hard dependency for Puppet. 

Change default crl_refresh_interval to 1 day 

Puppet agent now defaults to refreshing its certificate revocation list (CRL) once every 24 hours. 

Evaluate deferred functions lazily by default 

Deferred functions follow normal resource relationships and ordering, so it is now possible to install a dependency for a deferred function and call the deferred function in a single agent run. The previous behavior can be enabled by setting preprocess_deferred=false in puppet.conf on each agent. 

Exclude legacy facts by default 

Legacy facts are no longer collected on Puppet agent or sent to Puppet server. This saves network bandwidth and reduces Puppetserver's memory footprint when using templates.

Since legacy facts are not available during compilation, they cannot be referenced in Puppet code, ERB/EPP templates or Hiera configuration. The legacy_facts puppet-lint plugin can help identify and automatically correct legacy fact usage in Puppet code. For more information visit https://github.com/puppetlabs/puppet-lint/blob/main/lib/puppet-lint/plugins/legacy_facts/legacy_facts.rb.

Legacy facts can be re-enabled by setting include_legacy_facts=true in puppet.conf on each agent.

Replace c_rehash script with native openssl implementation 

Puppet agent 8 no longer bundles the c_rehash binary. Instead, users must rely on the bundled openssl binary's subcommand rehash. Example: /opt/puppetlabs/puppet/bin/openssl rehash. 

MRI Ruby 3.2 

Puppet agent vendors Ruby 3.2. Ruby 3.2 has several notable breaking changes that may affect Puppet extensions, such as functions, custom facts, types & providers, report processors, etc. For a complete list visit: https://github.com/puppetlabs/puppet/wiki/Puppet-8-Compatibility#ruby-32-compatibility

If Puppet is installed as a gem, then it requires Ruby 3.1 or greater.

OpenSSL 3.0

Puppet agent vendors OpenSSL 3.0. If an application compiles against Puppet's openssl, then the application must be recompiled. For more information visit https://www.openssl.org/docs/man3.0/man7/migration_guide.html

Resolved Issues

selinux: undefining the allocator of T_DATA class swig_runtime_data 

Patch selinux ruby native extension for Ruby 3.2 compatibility. 

ruby-shadow failing in Ruby 3.2 

Patch shadow ruby native extension for Ruby 3.2. 

Deprecations and Removals

Remove Windows ENV patches on Ruby 3 

The Puppet::Util methods for getting, setting, clearing and merging environment variables are still available, but are deprecated and will be removed in the next major release. Puppet 8 now uses Ruby's built-in ENV class to manage environment variables on Windows.

Remove extra cli option 

The extra CLI option, which was previously hidden, has been entirely removed. 

Drop openssl man pages and html docs 

OpenSSL man pages and html docs are no longer included in Puppet agent. 

Drop Hiera 3 Component 

This is a breaking change. The Hiera 3 gem is no longer vendored in puppet-agent packages, but may be installed separately.

If you rely on a Hiera 3 backend (a class that extends Hiera::Backend), you must convert your backend to Hiera 5 using the steps found at https://www.puppet.com/docs/puppet/latest/hiera_migrate.html, or manually install the Hiera 3 gem on all Puppet Server hosts. This change does not affect Hiera 5, puppet lookup or the hiera_include, hiera_hash, etc set of functions. 

Drop PSON support 

Support for the PSON (Pure JSON) serialization format has been removed. Puppet agents may fail if binary data is accidentally added to the catalog without using the Binary data type or binary_file function. For more information visit https://www.puppet.com/docs/puppet/latest/lang_data_binary.html.

It is possible, but not recommended, to reenable PSON support by installing the puppet-pson gem on all agents and server hosts and setting preferred_serialization_format=pson in puppet.conf on each agent.