.gitlab-ci.yml

@@ -10,22 +10,25 @@ cache:
 before_script:
   - bundle -v
   - rm Gemfile.lock || true
-  - gem update --system $RUBYGEMS_VERSION
+  - "# Update system gems if requested. This is useful to temporarily workaround troubles in the test runner"
+  - "# Set `rubygems_version` in the .sync.yml to set a value"
+  - "# Ignore exit code of SIGPIPE'd yes to not fail with shell's pipefail set"
+  - '[ -z "$RUBYGEMS_VERSION" ] || (yes || true) | gem update --system $RUBYGEMS_VERSION'
   - gem --version
   - bundle -v
   - bundle install --without system_tests --path vendor/bundle --jobs $(nproc)
 
-syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop-Ruby 2.5.3-Puppet ~> 6:
+syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop-Ruby 2.5.7-Puppet ~> 6:
   stage: syntax
-  image: ruby:2.5.3
+  image: ruby:2.5.7
   script:
     - bundle exec rake syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop
   variables:
     PUPPET_GEM_VERSION: '~> 6'
 
-parallel_spec-Ruby 2.5.3-Puppet ~> 6:
+parallel_spec-Ruby 2.5.7-Puppet ~> 6:
   stage: unit
-  image: ruby:2.5.3
+  image: ruby:2.5.7
   script:
     - bundle exec rake parallel_spec
   variables:

.rubocop.yml

@@ -4,7 +4,7 @@ require:
 - rubocop-i18n
 AllCops:
   DisplayCopNames: true
-  TargetRubyVersion: '2.4'
+  TargetRubyVersion: '2.1'
   Include:
   - "./**/*.rb"
   Exclude:
@@ -27,6 +27,7 @@ GetText/DecorateString:
   Description: We don't want to decorate test output.
   Exclude:
   - spec/**/*
+  Enabled: false
 RSpec/BeforeAfterAll:
   Description: Beware of using after(:all) as it may cause state to leak between tests.
     A necessary evil in acceptance testing.
@@ -39,6 +40,10 @@ Style/BlockDelimiters:
   Description: Prefer braces for chaining. Mostly an aesthetical choice. Better to
     be consistent then.
   EnforcedStyle: braces_for_chaining
+Style/BracesAroundHashParameters:
+  Description: Braces are required by Ruby 2.7. Cop removed from RuboCop v0.80.0.
+    See https://github.com/rubocop-hq/rubocop/pull/7643
+  Enabled: true
 Style/ClassAndModuleChildren:
   Description: Compact style reduces the required amount of indentation.
   EnforcedStyle: compact
@@ -67,7 +72,7 @@ Style/TrailingCommaInArguments:
   Description: Prefer always trailing comma on multiline argument lists. This makes
     diffs, and re-ordering nicer.
   EnforcedStyleForMultiline: comma
-Style/TrailingCommaInArrayLiteral:
+Style/TrailingCommaInLiteral:
   Description: Prefer always trailing comma on multiline literals. This makes diffs,
     and re-ordering nicer.
   EnforcedStyleForMultiline: comma
@@ -88,9 +93,15 @@ Style/MethodCalledOnDoEndBlock:
   Enabled: true
 Style/StringMethods:
   Enabled: true
+GetText/DecorateFunctionMessage:
+  Enabled: false
+GetText/DecorateStringFormattingUsingInterpolation:
+  Enabled: false
+GetText/DecorateStringFormattingUsingPercent:
+  Enabled: false
 Layout/EndOfLine:
   Enabled: false
-Layout/HeredocIndentation:
+Layout/IndentHeredoc:
   Enabled: false
 Metrics/AbcSize:
   Enabled: false

.sync.yml

@@ -1,14 +1,20 @@
 ---
 Gemfile:
-  ':development':
-     required:
-       - gem: 'puppet-debugger'
-         version: '>= 0.18.0'
+  required:
+    ':development':
+      - gem: 'puppet-debugger'
+        version: '>= 0.18.0'
+  optional:
+    ':development':
+      - gem: 'github_changelog_generator'
+        git: 'https://github.com/skywinder/github-changelog-generator'
+        ref: '20ee04ba1234e9e83eb2ffb5056e23d641c7a018'
+        condition: "Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.2.2')"
 Rakefile:
+  changelog_since_tag: '2.1.0'
   extras:
     - 'PuppetSyntax.exclude_paths = ["plans/**/*.pp", "vendor/**/*"]'
 .gitignore:
   paths:
     - '.rerun.json'
     - '*.tar.gz'
-

.travis.yml

@@ -1,26 +1,30 @@
 ---
+os: linux
 dist: xenial
 language: ruby
 cache: bundler
 before_install:
   - bundle -v
   - rm -f Gemfile.lock
-  - gem update --system $RUBYGEMS_VERSION
+  - "# Update system gems if requested. This is useful to temporarily workaround troubles in the test runner"
+  - "# See https://github.com/puppetlabs/pdk-templates/commit/705154d5c437796b821691b707156e1b056d244f for an example of how this was used"
+  - "# Ignore exit code of SIGPIPE'd yes to not fail with shell's pipefail set"
+  - '[ -z "$RUBYGEMS_VERSION" ] || (yes || true) | gem update --system $RUBYGEMS_VERSION'
   - gem --version
   - bundle -v
 script:
   - 'bundle exec rake $CHECK'
 bundler_args: --without system_tests
 rvm:
-  - 2.5.3
+  - 2.5.7
 stages:
   - static
   - spec
   - acceptance
   -
     if: tag =~ ^v\d
     name: deploy
-matrix:
+jobs:
   fast_finish: true
   include:
     -
@@ -32,7 +36,7 @@ matrix:
       stage: spec
     -
       env: PUPPET_GEM_VERSION="~> 6.0" CHECK=parallel_spec
-      rvm: 2.5.3
+      rvm: 2.5.7
       stage: spec
     -
       env: DEPLOY_TO_FORGE=yes

.vscode/extensions.json

@@ -1,6 +1,6 @@
 {
   "recommendations": [
-    "jpogran.puppet-vscode",
+    "puppet.puppet-vscode",
     "rebornix.Ruby"
   ]
 }

CHANGELOG.md

@@ -1,3 +1,12 @@
+## Release 2.1.0
+### Summary
+
+Support upgrades from PE 2018.1 to 2019.7.
+
+### Features
+
+- Support added for upgrading from PE 2018.1 to 2019.7
+
 ## Release 2.0.0
 ### Summary
 

Gemfile

@@ -17,18 +17,19 @@ ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments
 minor_version = ruby_version_segments[0..1].join('.')
 
 group :development do
-  gem 'puppet-debugger', '0.18.0'
   gem "fast_gettext", '1.1.0',                                   require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0')
   gem "fast_gettext",                                            require: false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0')
   gem "json_pure", '<= 2.0.1',                                   require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0')
   gem "json", '= 1.8.1',                                         require: false if Gem::Version.new(RUBY_VERSION.dup) == Gem::Version.new('2.1.9')
   gem "json", '= 2.0.4',                                         require: false if Gem::Requirement.create('~> 2.4.2').satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.1.0',                                         require: false if Gem::Requirement.create(['>= 2.5.0', '< 2.7.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "rb-readline", '= 0.5.5',                                  require: false, platforms: [:mswin, :mingw, :x64_mingw]
-  gem "puppet-module-posix-default-r#{minor_version}", '~> 0.3', require: false, platforms: [:ruby]
-  gem "puppet-module-posix-dev-r#{minor_version}", '~> 0.3',     require: false, platforms: [:ruby]
-  gem "puppet-module-win-default-r#{minor_version}", '~> 0.3',   require: false, platforms: [:mswin, :mingw, :x64_mingw]
-  gem "puppet-module-win-dev-r#{minor_version}", '~> 0.3',       require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "puppet-module-posix-default-r#{minor_version}", '~> 0.4', require: false, platforms: [:ruby]
+  gem "puppet-module-posix-dev-r#{minor_version}", '~> 0.4',     require: false, platforms: [:ruby]
+  gem "puppet-module-win-default-r#{minor_version}", '~> 0.4',   require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "puppet-module-win-dev-r#{minor_version}", '~> 0.4',       require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "puppet-debugger", '>= 0.18.0',                            require: false
+  gem "github_changelog_generator",                              require: false, git: 'https://github.com/skywinder/github-changelog-generator', ref: '20ee04ba1234e9e83eb2ffb5056e23d641c7a018' if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.2.2')
 end
 
 puppet_version = ENV['PUPPET_GEM_VERSION']

Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'puppet_litmus/rake_tasks' if Bundler.rubygems.find_name('puppet_litmus').any?
 require 'puppetlabs_spec_helper/rake_tasks'
 require 'puppet-syntax/tasks/puppet-syntax'
@@ -45,6 +47,7 @@ if Bundler.rubygems.find_name('github_changelog_generator').any?
     raise "Set CHANGELOG_GITHUB_TOKEN environment variable eg 'export CHANGELOG_GITHUB_TOKEN=valid_token_here'" if Rake.application.top_level_tasks.include? "changelog" and ENV['CHANGELOG_GITHUB_TOKEN'].nil?
     config.user = "#{changelog_user}"
     config.project = "#{changelog_project}"
+    config.since_tag = "2.1.0"
     config.future_release = "#{changelog_future_release}"
     config.exclude_labels = ['maintenance']
     config.header = "# Change log\n\nAll notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org)."

documentation/upgrade.md

@@ -98,16 +98,35 @@ Note: it is assumed that the Puppet master is in cluster A when the upgrade star
 3. Run the `install-puppet-enterprise` script for the new PE version on the master
 4. Run `puppet agent -t` on the master
 5. If different from the master, Run `puppet agent -t` on the PuppetDB PostgreSQL node for cluster A
-6. Perform the standard `curl upgrade.sh | bash` procedure on the compilers for cluster A
+6. Perform the compiler upgrade using `puppet infra upgrade compiler` for the compilers in cluster A
 
 **Phase 3: upgrade HA cluster B**
 
 1. Shut down the `pe-puppetdb` service on the compilers in cluster B
 2. If different from the master (replica), run the `install-puppet-enterprise` script for the new PE version on the PuppetDB PostgreSQL node for cluster B
 3. If different from the master (replica), Run `puppet agent -t` on the PuppetDB PostgreSQL node for cluster B
-4. Perform the standard `curl upgrade.sh | bash` procedure on the master (replica)
-5. Perform the standard `curl upgrade.sh | bash` procedure on the compilers for cluster B
+5. Run `puppet agent -t` on the master to ensure orchestration services are configured and restarted before the next steps
+6. Perform the replica upgrade using `puppet infra upgrade replica` for the master (replica)
+7. Perform the compiler upgrade using `puppet infra upgrade compiler` for the compilers in cluster B
+
+**If Upgrading from 2019.5**
+
+The following steps apply _only_ if upgrading from 2019.5 or older
+
+1. Run `puppet infra run convert_legacy_compiler` for all compilers
+2. Modify the peadm node groups "PE Compiler Group A" and "PE Compiler Group B" as follows:
+    * Re-parent the groups. They should be children of "PE Compiler"
+    * Remove configuration data (Hiera data). Leave the classes and class parameters
+    * Add the rule `trusted.extensions.pp_auth_role = pe_compiler`
+    * Remove the rule `trusted.extensions."1.3.6.1.4.1.34380.1.1.9812" = puppet/compiler`
 
 **Phase 4: resume puppet service**
 
 * Ensure the `puppet` service on all PE infrastructure nodes is running again
+
+## Upgrade from 2018.1
+
+To upgrade to PE 2019.7 or newer from PE 2018.1:
+
+1. Run the peadm::convert plan with `configure_node_groups = false`
+2. Run the peadm::upgrade plan

functions/validate_version.pp

@@ -1,7 +1,7 @@
 function peadm::validate_version(
   String $version,
 ) {
-  $supported = ($version =~ SemVerRange('2019.7.0'))
+  $supported = ($version =~ SemVerRange('>= 2019.7.0 < 2019.9.0'))
 
   unless $supported {
     fail(@("REASON"/L))
@@ -10,7 +10,7 @@ function peadm::validate_version(
       For PE versions older than 2019.7, please use version 1.x of the \
       puppetlabs-peadm module.
 
-      For PE versions newer than 2019.7, check to see if a new version of peadm \
+      For PE versions newer than 2019.8.x, check to see if a new version of peadm \
       exists which supports that version of PE.
 
       | REASON

manifests/setup/convert_pe2018.pp

@@ -0,0 +1,26 @@
+# @summary Defines configuration needed for converting PE 2018
+#
+class peadm::setup::convert_pe2018 {
+
+  # This is needed so that compiler certs can be signed. It's included by
+  # default in 2019.7 and newer, but isn't present in 2018.1. It would be
+  # preferable to use the hocon_setting resource, but we can't because it
+  # requires a gem not present by default. It would be preferable to use the
+  # pe_hocon_setting resource, but we can't because there's no Forge module
+  # that provides it for Bolt to use. So this is what we are reduced to.
+  $caconf = @(EOF)
+    # CA-related settings
+    certificate-authority: {
+      allow-subject-alt-names: true
+      allow-authorization-extensions: true
+    }
+    | EOF
+
+  file { '/etc/puppetlabs/puppetserver/conf.d/ca.conf':
+    ensure  => file,
+    content => $caconf,
+    notify  => Service['pe-puppetserver'],
+  }
+
+  service { 'pe-puppetserver': }
+}

metadata.json

@@ -1,7 +1,7 @@
 {
   "name": "puppetlabs-peadm",
-  "version": "2.0.0",
-  "author": "Puppet Labs Solutions Architecture",
+  "version": "2.1.0",
+  "author": "puppetlabs",
   "summary": "Bolt plans used to deploy an at-scale Puppet Enterprise architecture",
   "license": "Apache-2.0",
   "source": "https://github.com/puppetlabs/puppetlabs-peadm",
@@ -33,19 +33,22 @@
     {
       "operatingsystem": "RedHat",
       "operatingsystemrelease": [
-        "7"
+        "7",
+        "8"
       ]
     },
     {
       "operatingsystem": "CentOS",
       "operatingsystemrelease": [
-        "7"
+        "7",
+        "8"
       ]
     },
     {
       "operatingsystem": "Ubuntu",
       "operatingsystemrelease": [
-        "18.04"
+        "18.04",
+        "20.04"
       ]
     }
   ],
@@ -55,7 +58,7 @@
       "version_requirement": ">= 6.0.2 < 7.0.0"
     }
   ],
-  "pdk-version": "1.17.0",
-  "template-url": "https://github.com/puppetlabs/pdk-templates.git#1.13.0",
-  "template-ref": "tags/1.13.0-0-g66e1443"
+  "pdk-version": "1.18.0",
+  "template-url": "https://github.com/puppetlabs/pdk-templates.git#1.18.0",
+  "template-ref": "tags/1.18.0-0-g095317c"
 }