Secure manifest/catalog on node?

edit

You can disable catalog caching by setting catalog_cache_terminus="" in your node's puppet.conf file. I typically write a module that sets this parameter using ini_file, and removes any catalogs that might exist using a tidy resource. You may also want to check if your passwords are present in your run reports.

Keep in mind that this obfuscates your passwords, but does not truly protect them. The node could always modify puppet to extract the passwords or sniff the client/server communication. Best practice is to reduce or eliminate password reuse, and to try to avoid relying on the secrecy of your passwords for site security.

I'm not sure there's a good way to do this. If the puppet agent has a valid certificate, it can download its catalog from the puppet master - it has to be able to download the catalog in order to apply it.

Even if the puppet agent were to try and obfuscate things, there would be nothing preventing someone from presenting that same certificate using some other tool (curl would do nicely) and downloading the catalog that way.

I guess you could protect the private key for the agent's certificate using a passphrase, but then you'd need to have some way to supply the passphrase to the agent on startup - not easy if you have lots of servers to manage.