Q:

Encrypted Hiera eyaml variable decrypts on master but not on node

I just set up hiera-eyaml on my Puppet 3.8, opensource environment.
defaults.yaml
db_password: ENC[PKCS7,MXCGFDS......]

site.pp
$password=hiera(db_password)

If I'm running:
puppet master --debug --compile funky_hostname.mydomain.com --environment=dev

I can see that my tempated configfile is generating correctly:
password="password123"

But when I'm running it on the actual node (funky_hostname.mydomain.com), I'm getting the original, encrypted string as result:
password="ENC[PKCS7,MXCGFDS......]"

Isn't the Hiera decryption is happening on the puppet master side?

A:

It looks like there was multiple issues together, one of them is the permission of the key file.
$ chown -R puppet:puppet /etc/puppet/secure/keys
enter code here$ chmod -R 0500 /etc/puppet/secure/keys
$ chmod 0400 /etc/puppet/secure/keys/*.pem
$ ls -lha /etc/puppet/secure/keys
-r-------- 1 puppet puppet 1.7K Sep 24 16:24 private_key.pkcs7.pem
-r-------- 1 puppet puppet 1.1K Sep 24 16:24 public_key.pkcs7.pem

Also running the puppet master in --no-deamonize mode with --debug --verbose flags helps to track what's happening on both side.

