(PE-45697) Content-validate PuppetDB readiness over the ssl status port

[steveax]

Follow-up hardening on PE-45697 (does not reopen the ticket — the original fix shipped in 4.4.2 and stays as-is).

Background

PE-45697 stopped sleep_until_puppetdb_started from burning ~120 retries against PuppetDB's cleartext status port after it became disabled-by-default (PE-45384 / PE-44906, SECVULN-1792). It made the ssl leg the primary gate:

result = curl_with_retries('start puppetdb (ssl)', host, "https://#{host.node_name}:#{ssl_port}", [35, 60])

That curl_with_retries runs curl -m 1 https://<node>:8081 and accepts exit codes 35/60 (SSL connect / cert-verify error) as success — it confirms the TLS port answers, not that PuppetDB reports "state" : "running". The running-state content validation then only ran on the nonssl leg, which is best-effort (max_retries: 5) and swallowed. So on modern hosts (cleartext disabled) the readiness content check effectively never runs — reopening the "port up but PuppetDB not ready" race the check was originally added to guard (PE-14934).

Note: this leg was byte-identical before and after PE-45697 — the SSL path was always a bare TLS probe; PE-45697 just promoted it to primary. This PR is the follow-up hardening, not a regression fix on PE-45697 itself.

Change

Make an ssl content check the primary readiness gate: curl -m 1 -k https://localhost:8081/<endpoint> | grep '<running-regex>'. /status/v1/* (and the pre-4.0 /pdb/meta fallback) is allow-unauthenticated and PuppetDB's jetty listener is client-auth = want, so curl -k content-validates with no client cert and works even when the cleartext listener is disabled — the same endpoint and reasoning as the sibling beaker-pe fix #313.

If the ssl status endpoint doesn't serve unauthenticated content (older / nonstandard config), it degrades to the previous behaviour — a bare ssl liveness probe plus a best-effort nonssl content check — rather than failing. So this can't regress any currently-working path; worst case it behaves exactly like today.

Testing

• bundle exec rspec spec/beaker-puppet/helpers/puppet_helpers_spec.rb -e sleep_until_puppetdb_started — 10 examples, 0 failures (happy path, port overrides, both pe_ver endpoint branches, the fallback path, disabled-nonssl swallow, and unrelated-RuntimeError propagation for both legs).
• Full suite: 357 examples, 0 failures. rubocop clean.

Related

• Builds on PE-45697 (beaker-puppet 4.4.2).
• Sibling: beaker-pe #313 (same allow-unauthenticated /status assumption; both benefit from the same live re-verify).

🤖 Generated with Claude Code