Puppet run on Capsule fails when SELinux is enabled

Issue

Attempting Puppet run on Capsule is failing unless SELinux is disabled.

[root@capsule ~]# puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: Error 400 on SERVER: Failed to find capsule.com via exec: Execution of '/etc/puppet/node.rb capsule.com' returned 1:
Info: Retrieving pluginfacts
Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': Error 400 on SERVER: Permission denied - /etc/puppet/modules
Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet://capsule.com/pluginfacts: Error 400 on SERVER: Permission denied - /etc/puppet/modules
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': Error 400 on SERVER: Permission denied - /etc/puppet/modules
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet://capsule.com/plugins: Error 400 on SERVER: Permission denied - /etc/puppet/modules
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: No such file or directory - /var/lib/puppet/yaml/facts/capsule.com.yaml20170612-26566-qxgli9.lock
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run