Code manager is a client <-> server service built into

pe-puppetserver

. The server side runs on the PE Primary and exposes a HTTP API that receives deployment requests which it handles by: • Authorizing the request using a PE RBAC token. • Running

r10k deploy environment

for each control repo branch listed in the request. This step includes logic to safely run

r10k deploy

concurrently against multiple branches along with logic to prune the r10k caches to prevent them from growing too large. • When

r10k

finishes running, post-run scripts are executed. By default, this includes running

puppet generate types

on the environment, if needed. • The result of

r10k deploy enviroment

+ post run scripts is committed to an internal Git repository known as "File Sync Storage". • Optionally, the API call may wait before returning a HTTP response until all clients ACK the deployment is live or a timeout has elapsed. The client side runs in

pe-puppetserver

and

pe-orchestration-services

and: • Polls the Primary for new deployments, every 5 seconds. This polling request also serves as the deployment ACK by notifying the Primary of the latest environment versions the client has deployed. • If there are new deployments, runs a

git fetch

operation to pull commits from File Sync Storage to local client copies of the repository. • Deploys updated environments brought in by

git fetch

. These updates are made atomic either by a very heavy JRuby read+write lock (legacy deployment) or by creating a new versioned copy of the environment and updating a symlink (lockless deployment, modern default). Lockless deployment gets a significant speed boost from modern GNU coreutils that default to

cp --reflink=auto

and a filesystem that supports reflinks (XFS, BTRFS, ZFS, notably NOT EXT4). Basically, for best performance run PE infrastructure on RHEL 9 or newer or Ubuntu 24.04 or newer (but don't use Ubuntu's filesystem default of

ext4

) . • Performs cleanup of superseded environment content and git history. Code Manager also serves a dual purpose when DR is enabled in that it syncs deployed code, CA state, and PE configuration from the Primary to the Replica.