Installation and upgrade known issues

These are the known issues for installation and upgrade in this release.

Converting legacy compilers fails with an external certificate authority

If you use an external certificate authority (CA), the puppet infrastructure run convert_legacy_compiler command fails with an error during the certificate-signing step. 

Agent_cert_regen: ERROR: Failed to regenerate agent certificate on node <compiler-node.domain.com>
Agent_cert_regen: bolt/run-failure:Plan aborted: run_task 'enterprise_tasks::sign' failed on 1 target
Agent_cert_regen: puppetlabs.sign/sign-cert-failed Could not sign request for host with certname <compiler-node.domain.com> using caserver <master-host.domain.com>

To work around this issue when it appears:

  1. Log on to the CA server and manually sign certificates for the compiler.
  2. On the compiler, run Puppet: puppet agent -t
  3. Unpin the compiler from PE Master group, either from the console, or from the CLI using the command: /opt/puppetlabs/bin/puppet resource pe_node_group "PE Master" unpinned="<COMPILER_FQDN>"
  4. On your primary server, in the pe.conf file, remove the entry puppet_enterprise::profile::database::private_temp_puppetdb_host
  5. If you have an external PE-PostgreSQL node, run Puppet on that node: puppet agent -t
  6. Run Puppet on your primary server: puppet agent -t
  7. Run Puppet on all compilers: puppet agent -t

Converted compilers can slow PuppetDB in multi-region installations

In configurations that rely on high-latency connections between your primary servers and compilers – for example, in multi-region installations – converted compilers running the PuppetDB service might experience significant slowdowns. If your primary server and compilers are distributed among multiple data centers connected by high-latency links or congested network segments, reach out to Support for guidance before converting legacy compilers.

Puppet Enterprise HA upgrade fails on main for Amazon Linux 2 primary server

The puppet infra upgrade replica command may fail with errors downloading pe-postgres packages when running with a PE replica on AmazonLinux 2. Users can run the same command a second time in this case and the second attempt should succeed.

Infra Assistant returns "No active SSE connection for conversation" after upgrade to PE 2025.7 or later

After upgrading to PE 2025.7 or later, the Infra Assistant stops working, returning “No active SSE connection for conversation” for all query attempts.

As a workaround for this issue:

  1. In the PE console, navigate to Node groups → All Nodes → PE Infrastructure.

  2. Select the Classes tab.

  3. In the Add new class field, choose puppet_enterprise::profile::console from the drop-down menu.

  4. Click Add class.

  5. From the Parameter drop-down menu, select infra_assistant_proxy and set the value to true.

  6. Click Add to node group.

  7. Perform a Puppet run on the primary server.

If you need to use the MCP server for EdgeOps or Code Assist, follow the steps above. However, in step 5, select mcp_server_proxy from the Parameter drop-down menu and set the value to true.