Puppet users - Feb 2013 - Puppet 3 upgrade issue with auth.conf and fileserver.conf

Hi guys,

I just upgraded my puppet 2.7.x to Puppet 3. Upgrade is smooth except for 
one thing. I''m getting the error below:

Warning: Unable to fetch my node definition, but the agent run will 
continue:
Warning: Error 403 on SERVER: Forbidden request: [hostname] access to 
/node/[hostname] [find] at :0
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources 
using ''eval_generate: Error 403 on SERVER: Forbidden request:
[hostname]
access to /file_metadata/plugins [search] at :0
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Error 403 on SERVER: 
Forbidden request: [hostname] access to /file_metadata/plugins [find] at :0 
Could not retrieve file metadata for puppet://[hostname]/plugins: Error 403 
on SERVER: Forbidden request: [hostname] access to /file_metadata/plugins 
[find] at :0
Info: Loading facts in 
/etc/puppet/modules/augeas/lib/facter/augeasversion.rb
Info: Loading facts in 
/etc/puppet/modules/concat/lib/facter/concat_basedir.rb
Info: Loading facts in 
/etc/puppet/modules/firewall/lib/facter/ip6tables_version.rb
Info: Loading facts in 
/etc/puppet/modules/firewall/lib/facter/iptables_version.rb
Info: Loading facts in /etc/puppet/modules/mmm/lib/facter/ipaddresses.rb
Info: Loading facts in /etc/puppet/modules/stdlib/lib/facter/pe_version.rb
Info: Loading facts in 
/etc/puppet/modules/stdlib/lib/facter/puppet_vardir.rb
Info: Loading facts in /etc/puppet/modules/stdlib/lib/facter/root_home.rb
Info: Loading facts in /etc/puppet/modules/sudo/lib/facter/sudo.rb
Info: Loading facts in /etc/puppet/modules/xen/lib/facter/lvm_freespace.rb
Info: Loading facts in /var/lib/puppet/lib/facter/ip6tables_version.rb
Info: Loading facts in /var/lib/puppet/lib/facter/ipaddresses.rb
Info: Loading facts in /var/lib/puppet/lib/facter/lvm_freespace.rb
Info: Loading facts in /var/lib/puppet/lib/facter/sudo.rb
Info: Loading facts in /var/lib/puppet/lib/facter/puppet_vardir.rb
Info: Loading facts in /var/lib/puppet/lib/facter/root_home.rb
Info: Loading facts in /var/lib/puppet/lib/facter/iptables_version.rb
Info: Loading facts in /var/lib/puppet/lib/facter/pe_version.rb
Info: Loading facts in /var/lib/puppet/lib/facter/concat_basedir.rb
Info: Loading facts in /var/lib/puppet/lib/facter/augeasversion.rb
Error: Could not retrieve catalog from remote server: Error 403 on SERVER: 
Forbidden request: [hostname] access to /catalog/[hostname] [find] at :0
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

I looked at the changelog and telly workarounds but still the same thing. 

Made sure all the source => ''puppet:///modules/x/x/''

#### auth.conf

# allow nodes to retrieve their own node definition
path ~ ^/node/([^/]+)$
method find
allow $1

# allow nodes to retrieve their own catalog
path ~ ^/catalog/([^/]+)$
method find
allow $1

# allow all nodes to access the certificates services
path /certificate_revocation_list/ca
method find
allow *

# allow all nodes to store their reports
path /report
method save
allow *

# Allow all nodes to access all file services; this is necessary for
# pluginsync, file serving from modules, and file serving from custom
# mount points (see fileserver.conf). Note that the `/file` prefix matches
# requests to both the file_metadata and file_content paths. See
"Examples"
# above if you need more granular access control for custom mount points.
path /file
allow *

path /plugins
allow *

### Unauthenticated ACLs, for clients without valid certificates; 
authenticated
### clients can also access these paths, though they rarely need to.

# allow access to the CA certificate; unauthenticated nodes need this
# in order to validate the puppet master''s certificate
path /certificate/ca
auth any
method find
allow *

# allow nodes to retrieve the certificate they requested earlier
path /certificate/
auth any
method find
allow *

# allow nodes to request a new certificate
path /certificate_request
auth any
method find, save
allow *

# deny everything else; this ACL is not strictly necessary, but
# illustrates the default policy.
path /
auth any

path ~ ^/file_(metadata|content)/files/
auth yes
allow puppet.domain.com
allow 10.0.0.10

### fileserver.conf

# This file consists of arbitrarily named sections/modules
# defining where files are served from and to whom

# Define a section ''files''
# Adapt the allow/deny settings to your needs. Order
# for allow/deny does not matter, allow always takes precedence
# over deny
[files]
  path /etc/puppet/files
#  allow *.example.com
  allow *

[plugins]
#  allow *.example.com
#  deny *.evil.example.com
#  allow 192.168.0.0/24
  allow *

What am I doing wrong here?

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.

I''ve found the root cause and the solution to this problem. I was using
puppetlabs'' puppet modules to setup puppet agent and puppet master. The
whole setup puppetized the entire rack folder which contains config.ru.

The config.ru from the puppet module is the root cause as it does not match 
with the new config.ru which is used by puppet 3

### Puppet 2.7.x config.ru

# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
# $:.unshift(''/opt/puppet/lib'')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require ''puppet/application/master''
# we''re usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run


### Puppet 3 config.ru
# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
# $LOAD_PATH.unshift(''/opt/puppet/lib'')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"

# Rack applications typically don''t start as root.  Set --confdir and
--vardir
# to prevent reading configuration from ~puppet/.puppet/puppet.conf and writing
# to ~puppet/.puppet
ARGV << "--confdir" << "/etc/puppet"
ARGV << "--vardir"  << "/var/lib/puppet"

# NOTE: it''s unfortunate that we have to use the
"CommandLine" class
#  here to launch the app, but it contains some initialization logic
#  (such as triggering the parsing of the config file) that is very
#  important.  We should do something less nasty here when we''ve
#  gotten our API and settings initialization logic cleaned up.
#
# Also note that the "$0 = master" line up near the top here is
#  the magic that allows the CommandLine class to know that it''s
#  supposed to be running master.
#
# --cprice 2012-05-22

require ''puppet/util/command_line''
# we''re usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Util::CommandLine.new.execute

Changing the config.ru resolved all my problems above


-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.