Set YUM versionlock, but allow updating to specific versions

I am trying to control the version of puppet agent installed on our RedHat systems.

Our Puppet manifest has

$puppet_version = hiera('profile::puppet_agent::version', '6.12.0') class {'::puppet_agent': collection => 'puppet6', package_version => $puppet_version, service_names => [], # Don't start puppet service msi_move_locked_files => true, manage_pki_dir => false, } # This is required on RedHat 7 only $puppet_release = $::osreleasemaj ? { '7' => '*.el7.*', default => undef, } yum::versionlock { 'puppet-agent': ensure => present, version => $puppet_version, release => $puppet_release, before => Class['Puppet_agent'], } 

This works to configure puppet and it actually changes the contents of the YUM versionlock config file, but it doesn't seem to work to force puppet-agent to upgrade. I changed the version from 6.12.0 to 6.16.0. Now every puppet run fails with the error message Could not update: Failed to update to version 6.16.0, got version 6.12.0-1.el7 instead.

On RHEL 7, /etc/yum/pluginconf.d/versionlock.list contains:

# File managed by puppet 0:puppet-agent-6.16.0-*.el7.* 

On RHEL 8, /etc/yum/pluginconf.d/versionlock.list contains:

# File managed by puppet 0:puppet-agent-0:6.16.0-* 

My understanding is the yum versionlock doesn't care about the version listed in the file - just the package name.

I looked into whether puppet can clear the version lock, run the update, and set the version lock again all in the same agent run, but I can't find any way to make that work.

Any other way to do this?

We are running RHEL7 and RHEL8, and using the official Puppet YUM repositories.