The AVCs show this is because we're executing /etc/puppet/node.rb, so I think we need to relabel this as something more appropriate than puppet_etc_t file via the fcontexts.