puppetlabs/puppet · error · ArgumentError

Invalid argument '%{var}' at %{error_location}

Error message

Invalid argument '%{var}' at %{error_location}

What it means

The fileserver.conf parser accepts only `path`, `allow`, and `deny` keys inside a mount block. Any other key raises ArgumentError 'Invalid argument <key> at <file>:<line>' naming the offending entry. Note that allow/deny lines themselves are only warned about and ignored (Puppet 5+ deprecated them in fileserver.conf); unknown keys are hard errors.

Source

Thrown at lib/puppet/file_serving/configuration/parser.rb:46

          mount = newmount(::Regexp.last_match(1))
        when /^\s*(\w+)\s+(.+?)(\s*#.*)?$/
          var = ::Regexp.last_match(1)
          value = ::Regexp.last_match(2)
          value.strip!
          raise(ArgumentError, _("Fileserver configuration file does not use '=' as a separator")) if value =~ /^=/

          case var
          when "path"
            path(mount, value)
          when "allow", "deny"
            # ignore `allow *`, otherwise report error
            if var != 'allow' || value != '*'
              error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
              Puppet.err("Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}")
            end
          else
            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
            raise ArgumentError, _("Invalid argument '%{var}' at %{error_location}") %
                                 { var: var, error_location: error_location_str }
          end
        else
          error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
          raise ArgumentError, _("Invalid entry at %{error_location}: '%{file_text}'") %
                               { file_text: line.chomp, error_location: error_location_str }
        end
      end
    end

    validate

    @mounts
  end

  def initialize(filename)
    @file = Puppet::Util::WatchedFile.new(filename)
  end

View on GitHub (pinned to e227c27540)

Solutions

1. Open the reported file:line and remove or correct the key — only path, allow, deny are valid in a mount
2. Move ACL logic out of fileserver.conf: use auth.conf / server-side ACLs (allow/deny here are deprecated and ignored anyway)
3. Validate the file after editing: restart puppetserver and watch the log for parse warnings

Example fix

# /etc/puppetlabs/puppet/fileserver.conf — before
[extra_files]
  path /etc/puppetlabs/code/files/extra
  allow_ip 10.0.0.0/8
# after
[extra_files]
  path /etc/puppetlabs/code/files/extra
# (ACLs enforced in auth.conf instead)

VALID_KEYS = %w[path allow deny].freeze
File.readlines('/etc/puppetlabs/puppet/fileserver.conf').each_with_index do |line, i|
  key = line.split.first.to_s
  next if key.empty? || key.start_with?('#', '[')
  raise "fileserver.conf:#{i + 1}: invalid key '#{key}'" unless VALID_KEYS.include?(key)
end

begin
  Puppet::FileServing::Configuration.configuration_from(file)
rescue ArgumentError => e
  # e.message contains file:line of the bad entry — surface it to the operator
  raise "fileserver.conf rejected: #{e.message}"
end

When it happens

Trigger: fileserver.conf containing a key like `allow_ip 10.0.0.0/8` under a mount block (a Puppet 2.x-era option); a misspelled key (`pat /files`); keys copied from auth.conf or other Puppet configuration files.

Common situations: Configs migrated from very old Puppet versions; copy-paste from stale documentation; operators assuming fileserver.conf shares auth.conf's key vocabulary.

Related errors

• Paths must be fully qualified
• One or more file(s) specified did not exist: %{files}
• No input to parse given on command line or stdin
• Diff is not supported on this platform
• Relative paths must not be fully qualified

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/10bf9d77e9f82ace. Report an issue: GitHub.