Installation and upgrade known issues

These are the known issues for installation and upgrade in this release.

Converting legacy compilers fails with an external certificate authority

If you use an external certificate authority (CA), the puppet infrastructure run convert_legacy_compiler command fails with an error during the certificate-signing step. 

Agent_cert_regen: ERROR: Failed to regenerate agent certificate on node <compiler-node.domain.com>
Agent_cert_regen: bolt/run-failure:Plan aborted: run_task 'enterprise_tasks::sign' failed on 1 target
Agent_cert_regen: puppetlabs.sign/sign-cert-failed Could not sign request for host with certname <compiler-node.domain.com> using caserver <master-host.domain.com>

To work around this issue when it appears:

  1. Log on to the CA server and manually sign certificates for the compiler.
  2. On the compiler, run Puppet: puppet agent -t
  3. Unpin the compiler from PE Master group, either from the console, or from the CLI using the command: /opt/puppetlabs/bin/puppet resource pe_node_group "PE Master" unpinned="<COMPILER_FQDN>"
  4. On your primary server, in the pe.conf file, remove the entry puppet_enterprise::profile::database::private_temp_puppetdb_host
  5. If you have an external PE-PostgreSQL node, run Puppet on that node: puppet agent -t
  6. Run Puppet on your primary server: puppet agent -t
  7. Run Puppet on all compilers: puppet agent -t

[PE-28950]

Converted compilers can slow PuppetDB in multi-region installations

In configurations that rely on high-latency connections between your primary servers and compilers – for example, in multi-region installations – converted compilers running the PuppetDB service might experience significant slowdowns. If your primary server and compilers are distributed among multiple data centers connected by high-latency links or congested network segments, reach out to Support for guidance before converting legacy compilers. [PE-30260]

Puppet Enterprise HA upgrade fails on main for Amazon Linux 2 primary server

The puppet infra upgrade replica command may fail with errors downloading pe-postgres packages when running with a PE replica on AmazonLinux 2. Users can run the same command a second time in this case and the second attempt should succeed. [PE-39021]

Infra Assistant returns "No active SSE connection for conversation" after upgrade to PE 2025.7 or later

After upgrading to PE 2025.7 or later, the Infra Assistant stops working, returning “No active SSE connection for conversation” for all query attempts.

As a workaround for this issue:

  1. In the PE console, navigate to Node groups → All Nodes → PE Infrastructure.

  2. Select the Classes tab.

  3. In the Add new class field, choose puppet_enterprise::profile::console from the drop-down menu.

  4. Click Add class.

  5. From the Parameter drop-down menu, select infra_assistant_proxy and set the value to true.

  6. Click Add to node group.

  7. Perform a Puppet run on the primary server.

If you need to use the MCP server for EdgeOps or Code Assist, follow the steps above. However, in step 5, select mcp_server_proxy from the Parameter drop-down menu and set the value to true. [PE-43199]

Continuous Delivery 5.17.0 required when upgrading to Puppet Enterprise

In PE 2023.8.11, 2025.12.0, and 2026.0, Puppet Server requires certificate-based authentication for the /status/v1/services endpoint. Continuous Delivery for Puppet Enterprise (CD) uses this endpoint when discovering, creating, and updating PE integrations, and when running Impact Analysis. As a result, these operations can fail with HTTP 403 errors after upgrading PE.

Affected operations can include:

  • Creating a PE integration

  • Discovering PE integration settings

  • Editing an existing PE integration

  • Running Impact Analysis

Required action: Before upgrading to PE 2023.8.11, 2025.12.0, or 2026.0, upgrade Continuous Delivery for Puppet Enterprise to version 5.17.0 to avoid failures when integrating PE instances and running Impact Analysis. [CDPE-7470]

macOS agents upgraded to PE 2026.0 might not respond to orchestrator jobs

After upgrading a macOS agent to PE 2026.0, orchestrator-driven actions might fail on the affected node.

Affected operations include:

  • puppet job run and other orchestrator-triggered Puppet runs

  • puppet infra run regenerate_agent_certificate

  • Tasks and plans executed over PCP

The node might continue to appear healthy and connected in the orchestrator inventory even though module invocations fail.

This issue affects macOS agents on both Intel (x86_64) and Apple Silicon (arm64) architectures.

Workaround

Remove the stale erb gem files left behind by the previous installation. Removing these files restores normal module registration and orchestrator functionality. [PUPDOC-6127]

CA storage rollback plan can fail if a Puppet agent run is already in progress

In PE 2025.11.1 and later, if a Puppet agent run is in progress when you run the puppet_enterprise::ca_storage_export plan, the plan can fail during step 4 and leave the rollback partially completed. Running puppetserver ca storage --cleanup-fs before confirming the active backend can prevent pe-puppetserver from starting after a subsequent Puppet run.

Workaround

After the in-progress Puppet agent run completes, re-run puppet_enterprise::ca_storage_export. Before running puppetserver ca storage --cleanup-fs, verify the active backend with puppetserver ca storage --status. [PE-47193]