My Puppet master contains some sensitive files. I want each puppet agent to be able to access only those files that are of interest to that specific agent. In other words:
- Does the puppet agent run its catalog, and then, whenever it encounters a "file" or "template" function or a "source => 'puppet:///...'" parameter, asks the master to provide it with the specified file, and the master just provides it without checking? This would be bad. If an agent got compromised, it could ask the master for any file on the master, even files which are intended only for other agents.
- Or does the master somehow check that the agent's catalog really authorizes that particular agent to get that particular file?
I don't know if it matters, but I'm running passenger (and all my agents & master are 2.7.6 from squeeze-backports).