Rudder

See this output for example:

rudder     info: Executing 'no timeout' ... '/bin/systemctl restart rudder-slapd.service'
  notice: Q: ".../systemctl rest": Failed to open /dev/tty: No such device or address
Q: ".../systemctl rest": Failed to open /dev/tty: No such device or address
rudder     info: Last 2 quoted lines were generated by promiser '/bin/systemctl restart rudder-slapd.service'
rudder     info: Completed execution of '/bin/systemctl restart rudder-slapd.service'

The worst part is that systemctl happily returns "0" as a successful return code, even though it doesn't actually restart the service.

This is exactly the same as bug https://dev.cfengine.com/issues/5840 at CFEngine. The reason is that CFEngine commands are run in a new SID, which doesn't have access to /dev/tty, and systemctl requires it. A workaround, from that CFEngine bug, is to run the command with a body containing "no_output => true". This obviously has the side effect of suppressing any output.

I don't 100% understand why this workaround works, so I think we should study the CFEngine source code around it to understand what this is triggering, before blindly using it.