Problem using hiera-eyaml about hiera-eyaml HOT 6 CLOSED

Having the same issue. I can query a value using hiera on the puppet master, but the agent is unable to find it.

---
:backends:
  - eyaml
  - yaml

:yaml:
  :datadir: /etc/puppetlabs/puppet/hieradata

:eyaml:
  :datadir: /etc/puppetlabs/puppet/hieradata
  :pkcs7_private_key: /etc/puppetlabs/puppet/secure/keys/private_key.pkcs7.pem
  :pkcs7_public_key: /etc/puppetlabs/puppet/secure/keys/public_key.pkcs7.pem

:hierarchy: 
  - environments/%{::enviroment}
  - hosts/%{::fqdn}
  - datacenters/%{::datacenter}
  - passwords
  - users
  - common

passwords.eyaml:

---
sanpasswd: >
      ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQAw
      DQYJKoZIhvcNAQEBBQAEggEAypgw/O4KF5fGJmFnAzcNws/FJG3fjAGxgBxE
      ...
      bpugwTBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAlMIVlHd6egfWMFWPR
      LfJ2gCCpaZ0LIe8Uj+2ArmwRfOzBeegLfXi8Vl7CJLC1v/sJEQ==]

On the Puppet master:

# hiera -c /etc/puppetlabs/puppet/hiera.yaml  sanpasswd
redacted_password

On the node:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Could not find data item sanpasswd in any Hiera data file and no default supplied at /etc/puppetlabs/puppet/environments/production/site/mountpoint/manifests/init.pp:51 on node ...

Using Puppet Enterprise 3.0.1 (Puppet 3.2.4), CentOS 6, eyaml 2.0

from hiera-eyaml.

Got it. Puppet Enterprise runs under Passenger. You have to restart pe-httpd to get the Puppet master to pick up the config changes.

from hiera-eyaml.

Good to hear. Does that solve it for you too @wernerbahlke?

from hiera-eyaml.

@wernerbahlke
As an aside, I've been unable to ascertain which process reads the secure/keys directory (doesn't appear to be pe-puppet or pe-httpd), so I ended up having to have insecure permissions on those directories until I can get a ticket in with Puppetlabs. You'll probably have the same issue.

from hiera-eyaml.

Alas, no. Just tried to stop/start pe-httpd but no luck. In the meanwhile I discovered that I have two version of hiera. One in /usr/local/bin and one in /opt/puppet/bin. Only the one in /usr/local/bin gives me the unencrypted password with hiera -c hiera.yaml rootpwd. If I use the one in /opt/puppet/bin I get:

Cannot load backend eyaml: cannot load such file -- hiera/backend/eyaml_backend.

I had googled this before and there was a bug which should be fixed. I have upgraded hiera-eyaml to 2.0.0.

If I replace Puppet's hiera with the newer one in /usr/local/bin (hiera 1.3.0) using a symlink my hiera -c works again but still I get the data item not found.

The newer hiera was installed as a gem when I tried hiera-gpg.

Werner

from hiera-eyaml.

I also had the 400 error. eyaml commands were working but not hiera-eyaml.
default gem install uses the wrong gem environment. puppet uses a different one.
use /opt/puppet/bin/gem to install hiera-eyaml instead of default /usr/local/bin/gem

from hiera-eyaml.