When we create a symlink from the new cadir to the old cadir, we should ensure that the symlink has the same permissions as the actual cadir. It should be owned by the puppet user and group.
This includes when we create the symlink via
- puppetserver itself
- puppetserver-ca gem (setup, import)
- puppetserver-ca gem (migrate, including 6.x branch)
Need to apply correct permissions and ownership for all components.