(PE-45827) Query PuppetDB's unauthenticated status endpoint in check_puppetdb_status_endpoint

[steveax]

Problem

check_puppetdb_status_endpoint hard-fails with PuppetDB took too long to start on every PE upgrade since PuppetDB's cleartext 8080 listener became disabled-by-default (PE-45384 / PE-44906, SECVULN-1792) — even though PuppetDB is healthy on the SSL port.

The earlier fix for this (ba68b99, PE-45827) switched the probe to SSL but kept the /pdb/meta/v1/version endpoint, which is not allow-unauthenticated. A bare curl -k (no cert/token) is rejected:

$ curl -s -k https://localhost:8081/pdb/meta/v1/version
Permission denied: Must supply a certificate or token to access PuppetDB.
$ curl -s http://localhost:8080/pdb/meta/v1/version
Exited: 7            # cleartext listener disabled

Neither returns valid content, so the loop times out. Observed across the entire 2025.12.x upgrade lane, e.g. full-upgrade_nightly_2025.12.x #66 (46 failed cells) running beaker-pe 3.6.6 — i.e. the shipped PE-45827 fix does not actually resolve its own AC ("no longer fails when the cleartext listener is disabled").

Fix

Query /status/v1/services/puppetdb-status and validate "state" : "running" instead. /status/v1/* is allow-unauthenticated in PuppetDB's auth.conf, so curl -k gets a real, content-validated response with no client cert — the same endpoint the working sleep_until_puppetdb_started (beaker-puppet, PE-45697) uses. SSL-first with a cleartext fallback for older/nonstandard configs; the original PE-14934 response-content validation is preserved via the running-state match.

Testing

• bundle exec rspec spec/beaker-pe/install/pe_utils_spec.rb -e check_puppetdb_status_endpoint — 4 examples, 0 failures. Specs now assert the status endpoint and explicitly reject any /pdb/meta/ probe so this can't silently regress.
• Full suite: 305 examples, 0 failures.
• Recommended pre-merge: live re-verify via a mono-upgrade with BEAKER_PE_VERSION pointed at this branch (per PE-45827's re-verify path).

Related

• Supersedes/​completes ba68b99 (PE-45827).
• Sibling fixes: PE-45697 (beaker-puppet sleep_until_puppetdb_started), PE-45695 (pe_acceptance_tests call sites).
• Trigger: PE-45384 / PE-44906 (SECVULN-1792).

🤖 Generated with Claude Code

[steveax]

acceptance tests have been failing since Feb of 2025, merging and will follow up on the failing cells later