How can I detect in a shell script if the Puppet agent is disabled?

Question

With the Puppet agent disabled you'll get a notice like this when trying to manually run the agent:

Notice: Skipping run of Puppet configuration client; administratively disabled (Reason: 'reason not specified');
Use 'puppet agent --enable' to re-enable.

Also the agent will exit with a status code of 1, so the status "agent disabled" could be detected like this:

puppet agent --test --noop >/dev/null 2>&1
if [ $? -eq 1 ]; then
  echo 'puppet agent is disabled'
fi

However, running the agent (even if it's just a dry-run) is not very elegant. Is there a better way of detecting the agent status?

Answer 1

Disabling the Puppet agent creates a file /opt/puppetlabs/puppet/cache/state/agent_disabled.lock (re-enabling the agent removes it), so you can check for the presence of that file to detect whether or not the agent is disabled.

if [ -f /opt/puppetlabs/puppet/cache/state/agent_disabled.lock ]; then
  echo 'puppet agent is disabled'
fi

The file contains JSON data with the reason that was specified when disabling the agent, or the string "reason not specified" if the reason was omitted. That allows you to display the reason to other users or restore the original reason if you have to re-enable the agent temporarily.

Example:

The command

puppet agent --disable 'just for kicks'

will create the lock file with the following content:

{"disabled_message":"just for kicks"}

You can extract the message, then re-enable the agent for a test run, and disable it again with the original reason afterwards.

lockfile='/opt/puppetlabs/puppet/cache/state/agent_disabled.lock'
reason="$(jq -r '.disabled_message' "$lockfile")"
puppet agent --enable
puppet agent --test --noop
puppet agent --disable "$reason"

This is useful for instance when you're debugging Puppet manifests and want to have a notification in place so that other team members don't re-enable the agent by mistake.