Not working from puppet but working from hiera directly

[amartinj]

This is quite tricky. I've been searching the web for an answer but found nothing.
I have /etc/hiera.yaml as a symlink pointing /etc/puppet/hiera.yaml. I also have hiera_config=/etc/puppet/hiera.yaml in [master] section of /etc/puppet/puppet.conf.

My hiera config looks like this:

---
:backends:
  - gpg
  - yaml

:hierarchy:
  - common

:yaml:
  :datadir:
    - /etc/puppet/hieradata

:gpg:
  :datadir:
    - /etc/puppet/hieradata

When I run hiera locally either passing or not the config file with -c I get the correct value:

# hiera facebook.appId
012344556

But if I try to access a hiera value from puppet it doesn't fetch it unless set in /etc/puppet/hieradata/common.yaml:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Could not find data item facebook.appId in any Hiera data file and no default supplied at /etc/puppet/modules/funddy-website/manifests/clone.pp:16 on node clone.funddy.com

I'm using Ubuntu's Puppet version 3.0.2-1 from puppetlabs deb repo. I'm using Hiera version, also from puppetlabs with version 1.1.2-1. I installed hiera-gpg from a gem and got version 1.1.0.

I've had a look at syslog and the only message I'm getting when trying from puppet is the following:

Feb  1 19:45:30 puppet puppet-master[9524]: Could not find data item facebook.appId in any Hiera data file and no default supplied at /etc/puppet/modules/funddy-website/manifests/clone.pp:16 on node clone

When accessing locally, since everything works just fine, no log messages are generated.

I guess this is not a bug, but I'm stuck here and don't know how to carry on

[bunchc]

In the spirit of: http://xkcd.com/979/

I dug in a bit and found: http://comments.gmane.org/gmane.comp.sysutils.puppet.user/51019
After running in debug mode, we found that despite being configured to look elsewhere, it was looking for things in /var/lib/hiera/common.yaml, so that's where I put the config.

[santana]

Dear people from the future: check the permissions on files and directories under /etc/puppet/hieradata. You'll get the same error message if the puppet process cannot read those files.

[nvasudevan]

@santana Your trick worked! Thanks. The permission on the relevant yaml file under /etc/puppet/hieradata was set to 664 and changing it to 755 enabled puppet agent to look up the relevant fields.

[santana]

@nvasudevan given the sensitive nature of the data in /etc/puppet/hieradata, I prefer to make the puppet user/group own the directory and set the permissions so nobody else can read/write them.