Puppet

What is Puppet?

Puppet manages server configuration declaratively: you describe desired state in its Ruby-derived DSL — packages present, files templated, services running — agents check in with a Puppet server every 30 minutes, receive a compiled catalog, and converge the node toward it. That continuous-enforcement loop is Puppet’s signature: manual drift gets reverted on the next run, making config drift a transient rather than a slow rot. Facter feeds node facts into compilation; Hiera separates data from code; PuppetDB makes fleet state queryable — “which servers still run OpenSSL X?” is one query.

Puppet versus Ansible — the enduring fork

Ansible is push-based, agentless (SSH), procedural-ish, trivial to start; Puppet is pull-based, agentful, model-driven, heavier to bootstrap but stronger at enforcing state across thousands of nodes forever. The practical split: ad-hoc orchestration and small-to-mid fleets lean Ansible; large regulated estates that must prove configuration compliance continuously (the PuppetDB + enforcement-loop audit story) are where Puppet retains real gravity. Ordering is Puppet’s classic gotcha — resources apply in dependency order, not file order; forgotten require/notify relationships create heisenbug catalogs that pass in dev.

The strategic context

Immutable infrastructure shrank config management’s kingdom: baked images, containers, and Kubernetes mean fewer long-lived mutable servers to converge, and Terraform-style IaC took the provisioning layer. Puppet’s remaining stronghold is exactly the estate that isn’t going immutable — large VM fleets, compliance-bound enterprises, the OS layer under everything else.

What people get wrong

• Treating it as provisioning — Puppet configures machines that exist; creating them is IaC’s job.
• Skipping environments/r10k workflows: testing catalog changes in production because branching felt optional.
• Assuming file order equals run order — the dependency-graph lesson everyone learns via outage.

Primary source: Puppet documentation

Puppet’s Declarative Resource Model

Puppet configurations describe system state through resources (packages, files, services, users) and their desired properties, with Puppet’s agent-based architecture periodically checking each managed node against its assigned configuration and automatically correcting any detected drift back to the declared state — a continuous enforcement model distinct from tools that only apply configuration once at deployment time. This continuous convergence model has made Puppet historically popular for managing large fleets of long-lived servers where configuration drift over time (manual changes, ad-hoc fixes that were never codified) is a genuine operational risk, though its relevance has diminished somewhat as infrastructure has shifted toward more ephemeral, container-based and immutable infrastructure patterns where servers are replaced rather than continuously reconfigured in place.