Use of `puppet` in post-install script invites deadlock

Issue encountered upgrading puppet-agent at a customer site on RHEL 6, RHEL-7.

During a package upgade, the following sequence of events occurs.

1. yum install runs to install the package and obtains a yum lock
2. yum copies files and runs package scripts
3. during the post-install package script for puppet-agent, puppet apply is invoked: /opt/puppetlabs/bin/puppet apply /var/lib/rpm-state/puppet/service.pp

There's a little bit of a problem here customers can run into involving yum, and facts.

A customer I work with has a fact that invokes yum versionlock list. When puppet apply is run, it will invoke this fact. This yum commands requires the yum lock.

During an upgrade, this can create a deadlock situation. Yum runs and holds the lock to perform an install. The install post-install script invokes Puppet, which invokes Facter, which invokes a yum command that requires the yum lock and so blocks until it can get it. Because yum is in the middle of installing the package the lock is not available, and it won't be released until the post-install script completes. Deadlock.

Solution

We should avoid invoking Puppet during package install scripts for trivial actions like enabling the service, or else we should ensure that unknown customer code is not loaded when we do so.