Error 400/403 on Windows with mcollective+puppet in large amount of servers deployment

[Peiven Cheng]

Hi all,

We use mcollective to trigger puppet sync in windows servers.

While we send the 'mco puppet runonce' to trigger 8~10 servers doing puppet agent apply,

it occasionally happened the error of 

Could not retrieve catalog from remote server: Error 400 on SERVER: Could not find class test_1_0_4
for abc.tsmc at /userap/paas_ap/puppet/manifests/abc.pp:5 on node abc.tsmc

or

Could not evaluate: Error 403 on SERVER: Forbidden request: cba.tsmc(10.39.138.57) access to /module/test_dxp_1_0_3/TEST.zip [search] authenticated at

 /etc/puppet/auth.conf:99 Could not retrieve file metadata for puppet:///modules/test_dxp_1_0_3/TEST.zip: Error 403 on SERVER: Forbidden request: 

cba.tsmc(10.39.138.57) access to /module/test_dxp_1_0_3/TEST.zip [search] authenticated at /etc/puppet/auth.conf:99

These two errors only occurred in some server and other servers can apply the same class normally.

(Therefore, we though that the error was nothing to do with what it shows of configuration error since others can executed normally)

In this case, we usually redo puppet sync without doing any change and the error would gone.

Does anyone know why this two error exception would be triggered?

Any suggestions?

The auth.conf file line 99 is

# this one is not stricly necessary, but it has the merit

# to show the default policy which is deny everything else

path /

auth any

The version we used is 

Puppet master version: 2.7.23

Puppet client version: 3.4.3

mcollective version: 2.5.0

[Pete Brown]

I am not sure about your error but I am sure your puppetmaster needs
to be at least the same version as your agents.
A 2.7 master will have definitely have issues talking to a 3.4 client.

I would suggest upgrading puppet on your puppet master to 3.4.3 and
seeing if that fixes your issue.

> --
> You received this message because you are subscribed to the Google Groups "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/7ad0acae-80c4-4e09-b088-26e729c5b8e1%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.