title: How to use multiple different puppet masters from one puppet agent?
body: <p>There is the need that <strong>one</strong> puppet agent contacts <strong>some</strong> <strong>different</strong> puppet masters.</p>
  
  <p>Reason: there are different groups that create different and independent sets of manifests.</p>
  
  <p>Possible groups and their tasks</p>
  
  <ul>
  <li>Application Vendor: configuration of application</li>
  <li>Security: hardening</li>
  <li>Operations: routing tables, monitoring tools</li>
  </ul>
  
  <p>Each of these groups should run it's own puppet master - the data (manifests and appropriate data) should be strictly separated.  If it is possible, one group should even not see / have access to the manifests of the others (we are using MAC on the puppet agent OSes).</p>
  
  <p>Thoughts and ideas that all failed:</p>
  
  <ul>
  <li>using (only) hira is not flexible as needed - there is the need to have different manifests.</li>
  <li>r10k: supports more than one environment, but in each environment can only access one set of manifests.</li>
  <li>multi but same puppet server using e.g. DNS round robin: this is the other way round. We need different puppet masters.</li>
  </ul>
  
  <p>Some ways that might be possible but...</p>
  
  <ul>
  <li>running multiple instances of puppet agents. That 'feels' strange. Advantage: the access rights can be limited in the way as needed (e.g. the application puppet agent can run under the application user).</li>
  <li>patching puppet that it can handle more than one puppet master. Disadvantage: might be some work.</li>
  <li>using other mechanisms to split responsibility. Example: use different git-repositories. Create one puppet master. The puppet master pulls all the different repositories and serves the manifests.</li>
  </ul>
  
  <p>My questions:</p>
  
  <ol>
  <li>Is there a straight forward way implementing this requirement with puppet?</li>
  <li>If not, is there some best practice how to do this?</li>
  </ol>