Rudder

on ubuntu16.04, with rudder 4.1 nightly, i ran rudder-init, and webapp didn't start because of invalid postgres password
Passwords in /opt/rudder/etc/rudder-password.conf, /root/.pgpass and /opt/rudder/etc/rudder-web.properties match (11d3546c7882) but nobody warned postgresql that its password changed
Relevant logs are:

Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check LDAP in rudder-webapp.properties@
@None@@2017-03-23 09:25:33+00:00##root@#The Rudder Webapp configuration files were updated with a new LDAP password
Mar 23 09:25:37 server rsyslogd-2007: action 'action 13' suspended, next retry is Thu Mar 23 09:26:07 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check LDAP credentials@@None@@2017-03-2
3 09:25:33+00:00##root@#The OpenLDAP configuration file was updated with a new rootdn password
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@log_info@@server-roles@@server-roles-directive@@0@@Check rudder-passwords.conf file@@None@@2017-0
3-23 09:25:33+00:00##root@#rudder-slapd has been restarted
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder Method 'root_password_check_ldap' failed in some repairs
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check SQL in rudder-webapp.properties@@
None@@2017-03-23 09:25:33+00:00##root@#The Rudder Webapp configuration files were updated with a new SQL password
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_success@@server-roles@@server-roles-directive@@0@@Check SQL credentials@@None@@2017-03-23 
09:25:33+00:00##root@#The Rudder PostgreSQL user account's password is correct and works
Mar 23 09:25:37 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check rudder-passwords.conf and pgpass 
files@@None@@2017-03-23 09:25:33+00:00##root@#The Rudder passwords file permissions were fixed
Mar 23 09:25:37 server systemd[1]: Stopping LSB: Jetty 7 webserver...
Mar 23 09:25:40 server rudder-jetty[27777]: Stopping Jetty: OK
Mar 23 09:25:40 server systemd[1]: Stopped LSB: Jetty 7 webserver.
Mar 23 09:25:52 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@log_info@@server-roles@@server-roles-directive@@0@@Check rudder-webapp.properties@@None@@2017-03-23 09:25:33+00:00##root@#Jetty has been restarted
Mar 23 09:25:52 server systemd[1]: Reloading LSB: Apache2 web server.
Mar 23 09:25:52 server apache2[27977]:  * Reloading Apache httpd web server apache2
Mar 23 09:25:52 server apache2[27977]:  *
Mar 23 09:25:52 server systemd[1]: Reloaded LSB: Apache2 web server.
Mar 23 09:25:52 server rudder[26751]: CFEngine(agent) rudder Q: "...in/service apac": Failed to open /dev/tty: No such device or address
Mar 23 09:25:52 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check allowed networks configuration@@None@@2017-03-23 09:25:33+00:00##root@#The Rudder allowed networks configuration has been corrected
Mar 23 09:25:52 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@log_info@@server-roles@@server-roles-directive@@0@@Check allowed networks configuration@@None@@2017-03-23 09:25:33+00:00##root@#Apache has been reloaded successfully
Mar 23 09:25:52 server rudder[26751]: CFEngine(agent) rudder R: @@server-roles@@result_success@@server-roles@@server-roles-directive@@0@@Check WebDAV credentials@@None@@2017-03-23 09:25:33+00:00##root@#The Rudder WebDAV user and password are OK
...

next run
Mar 23 09:30:46 server rudder[29596]: CFEngine(agent) rudder R: @@server-roles@@result_repaired@@server-roles@@server-roles-directive@@0@@Check SQL credentials@@None@@2017-03-23 09:30:31+00:00##root@#The Rudder PostgreSQL user account's password has been changed

It ends up working because agent is running every 5 minutes and make it converge