Let Puppet deal with setting it's own permissions.

[razorsedge]

The Puppetmaster constantly sets directory modes back to some internal defaults. Lets let it control it's destiny.

[stephenrjohnson]

I've never seen puppet fight with the permissions we set on those files. Do you have an example run where it does?

[razorsedge]

Oct 31 06:58:53 ineptitude puppet-agent[22661]: (/Stage[main]/Puppet::Passenger/File[/var/lib/puppet/ssl/ca]/mode) mode changed '0755' to '0770'
Oct 31 06:58:54 ineptitude puppet-agent[22661]: (/Stage[main]/Puppet::Passenger/File[/var/lib/puppet/ssl/ca/requests]/mode) mode changed '0755' to '0750'

[stephenrjohnson]

I have this running fine on two production puppet masters and they don't fight over the file permissions. You don't have a resource{'file" setting anywhere do you ?

[razorsedge]

I have nothing else in my manifests that reference /var/lib/puppet/ssl/ca or /var/lib/puppet/ssl/ca/requests.

/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb does list the default permissiobns for the directories and I wonder if Puppet itself is keeping things a certain way.

[pall-valmundsson]

I'm seeing this as well. It kind of messes up my puppetboard as the puppet master is always applying some changes.