We run Puppet agent -t —environment=xx —onetime via cron daily. I can confirm the cron is executing and enforcement logs are visible on the server. Observation: Hiera changes made a few days ago have not taken effect on the few nodes. Running puppet agent --noop confirms the changes are still pending — they show up as “would change” but haven’t been applied. Question: Given that the cron-based enforcement appears to be running normally, what could explain why Hiera changes are not being picked up and applied?

####Puppet-agent noop output

[root@xxxxxx ~]# /opt/puppetlabs/bin/puppet agent -t --environment=timsp --noop

Info: Refreshing CA certificate

Info: CA certificate is unmodified, using existing CA certificate

Info: Refreshing CRL

Info: CRL is unmodified, using existing CRL

Info: Using environment 'timsp'

Info: Retrieving pluginfacts

Info: Retrieving plugin

Info: Loading facts

Notice: Requesting catalog from xxxxx:8140 (xxxxx)

Notice: Catalog compiled by xxxxxx

Info: Applying configuration version '1777636483'

Notice: /Stage[main]/Abb8::Cis3/Sysctl[net.ipv4.ip_forward]/value: changed configuration value from '0' to '1' and live value from '0' to '1' (noop)

Info: /Stage[main]/Abb8::Cis3/Sysctl[net.ipv4.ip_forward]: Scheduling refresh of Exec[/usr/sbin/sysctl -p]

Notice: /Stage[main]/Abb8::Sysctl/Exec[/usr/sbin/sysctl -p]: Would have triggered 'refresh' from 1 event

Notice: Class[Abb8::Sysctl]: Would have triggered 'refresh' from 1 event

Notice: Class[Abb8::Cis3]: Would have triggered 'refresh' from 1 event

Notice: Stage[main]: Would have triggered 'refresh' from 2 events

Notice: Applied catalog in 9.00 seconds

###enforcement via cron

[root@xxxxx ~]# crontab -l | grep -i onetime

33 21 * * * if [ ! -f /var/lock/autopatch.lock ]; then /opt/puppetlabs/bin/puppet agent --environment=timsp --onetime && /opt/puppetlabs/bin/puppet facts upload --onetime; fi

###Cron execution logs

[root@xxxxxx ~]# cat /var/log/cron | grep -i 'onetime' | grep -v 'use_cached_catalog'

May  3 21:33:01 xxxxx CROND[1638549]: (root) CMD (if [ ! -f /var/lock/autopatch.lock ]; then /opt/puppetlabs/bin/puppet agent --environment=timsp --onetime && /opt/puppetlabs/bin/puppet facts upload --onetime; fi)

May  3 21:34:00 xxxxx CROND[1638535]: (root) CMDEND (if [ ! -f /var/lock/autopatch.lock ]; then /opt/puppetlabs/bin/puppet agent --environment=timsp --onetime && /opt/puppetlabs/bin/puppet facts upload --onetime; fi)

[root@xxxxxx ~]#

###OS Logs (puppet-agent process)

[root@xxxxxx ~]# cat /var/log/messages | grep -i 'puppet-agent' | grep -i '21:33'

May  3 21:33:24 xxxxx puppet-agent[1638550]: Requesting catalog from xxxxx:8140 (xxxxxx)

May  3 21:33:29 xxxxx puppet-agent[1638550]: Catalog compiled by xxxxxxx

May  3 21:33:38 xxxxx puppet-agent[1638550]: Applied catalog in 8.48 seconds

[root@xxxxxx ~]#

We are running puppet-core version 8.16

What could be the reason for hiera changes not being picked as part of the non-cache enforcement run ?