Puppet users - May 2013 - hiera-gpg and 400 error

Hello

I am setting up servers with a puppetmaster and various nodes, all running 
Debian Wheezy with the Puppet 3 packages from Puppetlabs. The Puppetmaster 
is configured with Passenger and Apache.

I am trying to use hiera-gpg to encrypt passwords, I have it installed and 
have created a key as described here: 
http://www.craigdunn.org/2011/10/secret-variables-in-puppet-with-hiera-and-gpg/

On the Puppetmaster server I can use the encrypted data in a manifest and 
also access it on the commandline from heira.

However when I move to a node and run puppet agent -t, I get the following:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: 
undefined method `empty?'' for
#<Puppet::Util::Log:0x000000028697a8> at
/etc/puppet/modules/ssh_users/manifests/init.pp:10 on node xxx.xxx.net

The line in question seems to be a red herring as it errors on the first 
time it tries to use hiera data so it isn''t actually an issue within
that
module. Everything runs as expected if I remove the gpg backend from 
hiera.yaml

I did some searching and it seems the issue may be permissions related 
however I can''t seem to work out what the permissions should be.
I''m not
knowledgeable about gpg so this may be a user error. of a fairly basic 
variety so feel free to point out the obvious.

The keyrings folder is owned by puppet, permissions 0600, as are the 
contents of that folder.

Thanks in advance for any pointers!

Rachel

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.

On puppet version 3.0.0 there was a typo in the hiera.yaml file that 
prevented the gpg backend from loading so the data was never found.  If I 
remember right I think "backends" was just "backend".  Hiera
silently
failed back to loading just yaml without saying anything and gpg was never 
loaded.  Running the master in debug mode helped track it down.  Set ARGV 
<< "-d" in the config.ru to get debugging enabled on the master
when
running under Passenger with Apache.

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.

The solution lies in changing the ownership of the .gnupg folder to be 
owned by puppet.

chown -R puppet:puppet <your_gnupg_folder_w_secret_key>

 

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.