We had a problem on the DPM headnode with the new VOMS certificate for Zeus not being installed. When I checked I found it was in the repository, but had not been copied to the server. What gives? It turned out that the cfengine version we had on svr018 (2.2.3-1.el4) was not defining the gridsrv class properly (through the HostRange expansion), so then the grid class was not defined and consequently the vomsdir was not being checked.
I downgraded to 2.1.22 and this fixed the problem. But there is a mystery here - why does 2.2.3-1 work fine on the worker nodes?
I see 2.2.6 has been released. Maybe we should go back to rolling out own build of cfengine?