Autoaccept all Certs on Puppet Master

Are you looking to keep both puppet masters up and running for a time, and migrate clients over a little at a time?

If so, you're stuck touching each client system regardless; whether it's to point to a new master, or add a hosts file entry, or some such. If that's the case, then you might as well just start the new master fresh and re-sign each client (it's better than a hosts file hack to work around the validation issues).

If not (if you're planning to take down the old server and cut everything over at once), then just take the old server's hostname over with the new server; the certificate will be recognized as valid if the clients are connecting to the new server on the old name (the name that is on the certificate).

The documentation for the Puppet File Server should be able to cover most of what you are asking. In particular see the security section.

First a note. If you have autosign enabled, then pretty much any security offered is moot. You should verify each certificate. Since security settings you configure will be based on the hostname/certname or a regex match them, having autosign enabled would potentially mean that any un-trusted system could simple request a cert for a name that matched a pattern that had access to secret files.

By default anything in the special plugins and modules fileserver mounts are avialable to any client. But this can be controlled to a certain extent through the configuration.

You can also setup custom 'mounts' that point to specific locations. An example is provided in the documentation about how to create a [private] mount for distributing private SSH keys. The host name is used as part of the mount path, so a given host can only see files that belong to it.