Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I restrict the puppet agent commands? I need to only allow the puppet agent to run without noop against the production branch.

  • Block puppet agent --test --environment devbranch
  • Allow puppet agent --test --environment devbranch --noop
  • Allow puppet agent --test --environment production

I think some kind wizardry in auth.conf should be able to take care of this but I'm not familiar enough to do so.

share|improve this question
I am tempted to believe that you could put a noop = true in the [devbranch] section, of the puppet.conf so it at least defaults to noop, but I haven't tried it. – Zoredache Sep 5 '13 at 16:45
@Zoredache that sounds promising. I'm using dynamic modules paths under the [main] section so it's a bit more complicated Would a noop there and a noop=false in production potentially work? – Tim Brigham Sep 5 '13 at 18:08
No idea really. I don't have a good place to test at the moment, so you'll have to try it. – Zoredache Sep 5 '13 at 18:12
@Zoredache with a few tweaks that did it. Thanks. – Tim Brigham Sep 5 '13 at 19:53
up vote 1 down vote accepted

With thanks to @Zoredache I have managed to get this build the way I need.

I'm using the [main] section to dynamically create and manage branches and [production] to override the noop setting. I'm sure it could also be done in [agent] but I already had it started here.

    logdir = /var/log/puppet
    rundir = /var/run/puppet
    confdir = /puppet/$environment
    vardir = /puppet/.$environment-var
    environment = production
    server =
    pluginsync = true
    noop = true
    # Disable running all branches by default

    noop = false

EDIT: Looks like I spoke too soon. The noop is bleeding through. Although the syntax above is right one of the caviats I looked over won't let this work.

.. environments have some limitations, most of which are known bugs or vagaries of implementation rather than design choices.

Puppet will only read the modulepath, manifest, manifestdir, and templatedir settings from environment config blocks; other settings in any of these blocks will be ignored in favor of settings in the [master] or [main] blocks. (Issue 7497)

share|improve this answer

You can't do it like that, someone that have access to commandline could enforce pretty much any option.

If you want to control who can deploy what env I'd advise to use MCollective for running puppet. You can make pretty detailed ACLs there, and it can coordinate puppet on multiple nodes and do stuff like "deploy on 2 machines, if it doesn't fail, deploy on next 10, if it doesn't fail, deploy on rest".

share|improve this answer
I realize that it's possible to override the noop setting if desired. It's mostly a safety thing to set the default to something sensible. – Tim Brigham Sep 17 '13 at 14:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.