Do you know which Puppetlabs modules get more attention during review cycles? Why do some modules get more releases than others? For a long time there hasn't been much structure or visibility around this and I wanted to document publicly how we are going to make prioritization decisions on Puppetlabs modules work. The modules in the Puppetlabs namespace are now going to have documented priority tiers. 

I wrote about the structuring of which modules have been placed in Tier 1, Tier 2, and Tier 3 to help give the Puppet team focus on which modules matter most to customers and the community.

The goal here is to help with prioritizing work across these modules and to set expectations around responsiveness on certain modules. Every day I'm going through PRs, or issues, or comments and looking for ways to help move things forward, and our tiers will help us focus that time where it is needed most.

That said: we need feedback on this. We're pretty solid on which modules are the highest tier and most used by our customers and community, but I will be honest that our Tier 2 and Tier 3 tiers likely need to get more feedback so we can represent these accurately to how people are using these modules today. I want to hear from you!

You can check out the full write-up on the Puppet blog ⬇️

https://www.puppet.com/blog/puppetlabs-module-tiers

openvox-gui 3.10.6 stable: faster Dashboard (lean PDB extract), multi-worker serving, SWR on all Insights graph pages. docs/PERFORMANCE.md

https://github.com/cvquesty/openvox-gui/releases/tag/v3.10.6

**openvox-gui 3.9.5 released** - Node Health for your fleet, better fact viz, and scrolling fixes

Hey [r/Puppet](r/Puppet) / [r/sysadmin](r/sysadmin),

Just pushed v3.9.5 of openvox-gui (the open-source Puppet/OpenVox management UI).

New: Metrics | Node Health

See at a glance which agents are disabled. Uses a simple custom fact + on-demand Bolt checks that work even if the agent itself is stopped.

### Fact Distribution The fact overview page now has proper Recharts graphs instead of the old basic ones. Numeric facts show as sorted distribution curves, categorical as expandable bars.

### Fleet Compliance The per-category node lists ("Compliant", "Failed", etc.) are now properly scrollable and sorted alphabetically by certname.

### Other Installer now helps with the `puppet_agent_disabled` fact script.

Download :

https://github.com/cvquesty/openvox-gui

As always, feedback/PRs welcome.

We’re getting close to a major update with puppetlabs-stdlib 10, targeted for June 30, 2026 and there are a couple of important things to know ahead of time.

- Puppet 7 support is being removed (it reached end-of-life in Feb 2025)

- Ruby 3.1+ is now required

- Existing modules pinned to < 10.0.0 will keep working on stdlib 9.x as-is

- No immediate action is required, but module authors should start planning upgrades

This is one of the most widely used modules in the Puppet ecosystem, so we’re sharing early to make sure maintainers have time to prepare and avoid surprises.

If you’re maintaining modules, now's a good time to review your dependency bounds and CI environment.

More details in the official post:

https://www.puppet.com/blog/puppetlabs-stdlib-10

I'm trying to set up bolt to securely connect to my windows servers over winrm. I get the message that "certificate verify failed (unable to get local issuer certificate)" I created a legit certificate with our company's CA. Imported the certificate into the Windows store. Exported the certificate w/o private key from Windows and changed the extension to .pem. I Then point to that pem for the CA in my inventory. I've also tried copying the CA that puppet creates from windows to the linux machine and using that. Any ideas?

What it says on the tin.

I’ve been using Puppet since 0.24.x and PE for well over a decade. I don’t need my hand held, but it would be nice to know that folks have successfully done this and to learn from those experiences.

Maintainer here. Just cut the 3.6 release of [openvox-gui](https://github.com/cvquesty/openvox-gui) -- the open-source web GUI for managing an OpenVox (the open-source Puppet fork) installation. Two things worth your attention if you run OpenVox:

**Agent installer.** If you came to OpenVox from PE, you probably miss the `curl ... | sudo bash` agent bootstrap. 3.6 brings it back: one-liner for Linux, equivalent PowerShell for Windows, backed by a local mirror at `/opt/openvox-pkgs/` synced nightly from voxpupuli.org. The bootstrap script figures out the puppetserver FQDN on its own (reads `/proc/net/tcp`, reverse-DNSes the curl connection that downloaded it), installs the puppet CA into the system trust store, handles corporate proxy bypass, and signs the CSR from the same page in the GUI.

```
curl -k --noproxy <fqdn> https://<fqdn>:8140/packages/install.bash | sudo bash
```

**Security hardening.** Did an audit at the end of the test cycle and closed every CRITICAL/HIGH:

- Per-route role enforcement on every privileged endpoint. Pre-3.6, any authenticated user including `viewer` could trigger Bolt commands as root, sign/revoke certs, edit Hiera, restart the puppet stack. Now each endpoint declares its minimum role.
- Deploy webhook now requires HMAC-SHA256 sig verification with a shared secret. Disabled by default. Pre-3.6 it was an open r10k-deploy-as-root entrypoint.
- JWT logout actually revokes the token now (server-side denylist via `jti` claim). Pre-3.6, `/logout` only deleted the cookie -- the JWT itself stayed valid for its full 24h expiry.
- LDAP bind password encrypted at rest with Fernet. Was previously plaintext in SQLite despite the column comment claiming otherwise.
- Tightened sudoers wildcards -- replaced `openssl x509 *` (which allowed arbitrary file write as root) with per-form rules.

Plus 3.6.2 patches two Dependabot findings (postcss XSS, python-multipart DoS).

Apache-2.0 licensed. Repo: https://github.com/cvquesty/openvox-gui

Happy to answer questions or take feedback in the thread.

I would like to share a recent side project with the community: jig, which is a Go-based reimplementation of the Puppet Development Kit.

When Perforce transitioned PDK to a closed-source model, it left a significant gap for those who rely on open-source tooling. Additionally, the Ruby runtime required by PDK has long presented challenges, particularly in CI environments where minimizing dependencies is important. jig addresses these concerns by providing a single static binary that does not require any external runtime.

At present, my objective is to reimplement all new <whatever> functions, along with the build and release capabilities. While I frequently rely on pdk for validation and testing, the choice of Go for this project introduces significant challenges in these areas. To my knowledge, there is no existing Puppet language parser for Go, which means that replicating the validate function would require developing one from the ground up. I am considering whether to pursue this undertaking. Regarding unit testing, this may not be feasible, as the existing tests are written in Ruby and utilize RSpec.

The README for the project is pretty comprehensive, though written by Claude.

Welcome to r/Puppet. Please note that this space is for configuration management and devops, not puppetry!

This is an unofficial, community-run subreddit for Puppet and OpenVox users where open source software is in our DNA. Ask questions, share tips, troubleshoot issues, and swap stories about Puppet modules and Bolt tasks, or ecosystem tools like the PDK, voxpupuli-test, or modulesync, and even Foreman or other adjacent tools. Bring details, be kind, and help each other out. Help us keep this space a welcoming community ecosystem.

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, suggestions, or questions and engage in thoughtful conversations with others.

Posting Guidelines:

• Obvious spam will be deleted and spammers blocked. Please don't be that guy.
• Posts and videos about puppets and puppetry will be removed, even if they're cute -- r/puppets is over that way.
• This space is for genuine person-to-person engagement. Please no sales, marketing, promotion, spray-n-pray recruiting, etc. Project and product announcements are fine.
• Allowed recruiting/jobs posts: the last few years have been brutal for the tech industries. We are now allowing a reasonable number of on-topic job postings, which must be:
  • Relevant to this audience. That doesn't necessarily mean Puppet and only Puppet, but it must be something that a Puppet practitioner would likely be interested in.
  • Specific and descriptive. The post should describe the role and why it's relevant to the group. It does not necessarily need to be technical in nature, as long as the point of posting here is to select for Puppet expertise
  • Authentic. The post should describe a real job that's open and available right now. Evergreen roles that just stay open all the time whether or not the company is actually hiring are not welcome.
  • Scoped to this group. The post should be written specifically for this group (and maybe just a few others, like the DevOps group or the Cloud Native group.) Copy pasting the same post across 47 unrelated groups is not welcomed.

Community Vibe
We want to keep the Puppet communities like this one awesome, and we need your help to keep it that way. r/Puppet honors the Puppet Community Code of Conduct

Thanks for being here. Together, let's make r/Puppet amazing.

ℹ️ NOTE: This notice was originally posted by the Product Team on 2026-03-12

Perforce Puppet has posted a 90-day notice that Puppet Agent support for the following operating system platforms is reaching End of Life (EOL). Support for these platforms will be discontinued in upcoming Puppet releases:

• Amazon Linux 2
• Debian 10
• Fedora 40
• Red Hat Enterprise Linux 7
• Ubuntu 18.04
• Ubuntu 20.04
• Windows 10

After this period, these platforms will no longer receive updates or be included in future puppet-agent releases.

If you have any questions or concerns regarding this change, please don’t hesitate to reach out!

Since the beginning, all Puppet community spaces have held out against recruiter posts because they were relentless. But economic realities are changing and the last couple of years have been brutal. I suspect that many of us here would appreciate a reasonable number of on-topic job listings.

I propose that we start allowing job postings that are - Relevant to this audience. That doesn't necessarily mean Puppet and only Puppet, but it must be something that a Puppet practitioner would likely be interested in. - Specific and descriptive. The post should describe the role and why it's relevant to the group. - Authentic. The post should describe a real job that's open and available right now. Evergreen roles that just stay open all the time whether or not the company is actually hiring are not welcome. - Scoped to this group. The post should be written specifically for this group (and maybe just a few others, like the DevOps group or the Cloud Native group.) Copy pasting the same post across 47 unrelated groups is not welcomed.

The post does not necessarily need to be technical in nature, as long as the point of posting here is to select for Puppet expertise. For example, we would all benefit if Perforce were to hire technical writers or product managers with Puppet expertise and so these posts are welcomed.

Using our lazy consensus model, two weeks from now on March 21 I'll change our policies unless there's significant pushback. You can comment on this post or contact any of the mod team to offer feedback.

This is probably incredibly dumb, but I've hitting my head on this for some time - wondering if someone can give me a pointer as it's probably quite simple.

I'm trying to take a template of a hash that looks something like this:

'template' => { 'value1' => '1', 'value2' => '2', config => { 'value3' => '3' } }

And I need to insert a new hash into 'config' while retaining the rest of the template. All I've managed to do is add the new value for the config subhash into the top level hash.

I can probably do this by dumping the 'template' and constructing the hash entirely from scratch within my .each loop but for clarity it'd be good to know how to do this by inserting a new hash into the 'config' bit of the existing template.

Thanks. Hope that makes sense.

I maintain both ubtuntu 22.04 and 24.04 servers. Using puppet-7 and puppet-8. The apt-module from puppetlabs has been updated to support Ubuntu-24.04 style of apt-repos. But the apt-module is not compatible with puppet-7 so I can't use that apt-module for all my servers. How do you normally handle this. I thought puppet was meant to work in a general way and be smart about how to configure things on a server. Now I'm struggling with puppet versions instead. Any ideas?

Do share if any roadmap available for puppet - step by step guide to learn everything in puppet.

Ok short introduction:

I am working for a customer who is using a puppet enterprise infrastructure but everything is old. We are using puppet 7 on 3500 Linux machines.

There is no ci/cd for the puppet modules, no testing, no multi environment for branching. All servers are running in production.

We have acc en prd, that’s it.

The last person who build everything is retired. My team is not skilled enough to think about this, hopefully you guys can help me out.

My plan is to:

- upgrade all modules to v8/9

- install new puppet servers compilers

- install puppetdb

- use pdk for gitlab

- testing for all modules

- enable linting

Any more suggestions? Many thanks

Is it me, or is bolt 5 not able to figure out that I am running it/project from a Windows machine? 2025-12-03T17:34:47.702775 INFO [exec-worker-1] [Bolt::Executor] [{"target":"db.fqdn.com","action":"apply","object":null,"status":"failure","value":{"_error":{"kind":"puppetlabs.tasks/task-error","issue_code":"TASK_ERROR","msg":"The task failed with exit code 1 and no stdout, but stderr contained:\n/opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/errors.rb:159:in fail': Parameter source failed on File[postgres private key]: Cannot use URLs of type 'c' as source for fileserving (file: C:/Users/mihai/zdev/puppet_course/.modules/puppetdb/manifests/database/ssl_configuration.pp, line: 23) (Puppet::ResourceError)\n\tfrom /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type/file/source.rb:100:inblock (3 levels) in <module:Puppet>'\n\tfrom /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type/file/source.rb:88:in each'\n\tfrom /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type/file/source.rb:88:inblock (2 levels) in <module:Puppet>'\n\tfrom /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/parameter.

I built a small utility that converts .erb (embedded ruby) templates to .epp (embedded puppet ) format.

https://github.com/artonix101/erb-to-epp

Would love feedback, edge cases, or ideas for improvement!

I'm constantly crashing with 'fatal error: OutOfMemory encountered: Java heap space' on puppetserver.
The puppetserver is run with the '-Xms2g -Xmx8g' jvm parameters and there are only a max of 4 agents connectied to it.

sections of the puppetserver crash log

--------------- S U M M A R Y ------------

Command Line: -Xms2g -Xmx8g -Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger -Djruby.lib=/usr/share/jruby/lib -XX:+CrashOnOutOfMemoryError -XX:ErrorFile=/var/log/puppetserver/puppetserver_err_pid%p.log /usr/share/puppetserver/puppetserver.jar --config /etc/puppet/puppetserver/conf.d --bootstrap-config /etc/puppet/puppetserver/services.d --restart-file /run/puppetserver/restart

Host: Common KVM processor, 16 cores, 15G, Debian GNU/Linux 13 (trixie)

Time: Sun Oct 12 03:33:13 2025 GMT elapsed time: 1629.511495 seconds (0d 0h 27m 9s)

...

--------------- S Y S T E M ---------------

OS:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)"

NAME="Debian GNU/Linux"

VERSION_ID="13"

VERSION="13 (trixie)"

VERSION_CODENAME=trixie

DEBIAN_VERSION_FULL=13.1

ID=debian

HOME_URL="https://www.debian.org/"

SUPPORT_URL="https://www.debian.org/support"

BUG_REPORT_URL="https://bugs.debian.org/"

uname: Linux 6.12.48+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.48-1 (2025-09-20) x86_64

OS uptime: 0 days 2:30 hours

libc: glibc 2.41 NPTL 2.41

rlimit (soft/hard): STACK 8192k/infinity , CORE 0k/infinity , NPROC 63595/63595 , NOFILE 524288/524288 , AS infinity/infinity , CPU infinity/infinity , DATA infinity/infinity , FSIZE infinity/infinity , MEMLOCK 8192k/8192k

load average: 13.12 14.02 15.07

/proc/meminfo:

MemTotal: 16373044 kB

MemFree: 2309568 kB

MemAvailable: 3486364 kB

Buffers: 76136 kB

Cached: 1310248 kB

SwapCached: 0 kB

Active: 12277496 kB

Inactive: 1144348 kB

Active(anon): 12031332 kB

Inactive(anon): 0 kB

Active(file): 246164 kB

Inactive(file): 1144348 kB

Unevictable: 4000 kB

Mlocked: 0 kB

SwapTotal: 8388604 kB

SwapFree: 8388604 kB

Zswap: 0 kB

Zswapped: 0 kB

Dirty: 5564 kB

Writeback: 0 kB

AnonPages: 12018076 kB

Mapped: 245740 kB

Shmem: 5264 kB

KReclaimable: 76932 kB

Slab: 167808 kB

SReclaimable: 76932 kB

SUnreclaim: 90876 kB

KernelStack: 9240 kB

PageTables: 31228 kB

SecPageTables: 0 kB

NFS_Unstable: 0 kB

Bounce: 0 kB

WritebackTmp: 0 kB

CommitLimit: 16575124 kB

Committed_AS: 14718944 kB

VmallocTotal: 34359738367 kB

Percpu: 8768 kB

HardwareCorrupted: 0 kB

AnonHugePages: 8720384 kB

ShmemHugePages: 0 kB

ShmemPmdMapped: 0 kB

FileHugePages: 0 kB

FilePmdMapped: 0 kB

Unaccepted: 0 kB

HugePages_Total: 0

HugePages_Free: 0

HugePages_Rsvd: 0

HugePages_Surp: 0

Hugepagesize: 2048 kB

Hugetlb: 0 kB

DirectMap4k: 191960 kB

DirectMap2M: 16578560 kB

We are currently using puppet 7.x in our company. I do like to switch to ansble because I think it is way easier. Are here people who have transitioned from ansible and can elaborate on the why?

Or does someone has evaluated both bevore start to use it and decided to go with puppet: Can you elabrate on the key factors for decisions?

Hi all

I am looking for more information on if there is any APIs/integrations between Puppetboard failures and raising a ticket on service now?

So basically when a failure when one of our nodes occurs it will raise an automated ticket onto service now? If the related nodes issues resolves it will then clear out on puppet and close the service now ticket?

Any help/information would be really appreciated greatly appreciated!

I am using the excellent powershell module with Windows agents, have used it for a while but stuck on a unique use-case: Need to install a 3rd party app as a non-SYSTEM user (in Administrators group). I can run a PS script from a PS shell that creates a credential with the admin user, then uses either Start-Process or Invoke-Command to successfully run it. However, when I have the puppet agent run it (no terminal, SYSTEM user), it simply does not run; debug output is empty. Anyone here do anything like this before? Ideas?

I work in help desk jr sysadmin work and I was offered a role with puppet internally. The role is titled configuration management/devops engineer. Im the only one who’s going to be working on puppet, it’s going to be my role for me only. There’s a little friction on who I should be reporting too. And if my role really revolves around operations or security. I don’t know who it should fall under, but puppet was purchased by the security team and it seems like they “own it”.

For the past week I’ve had to split time between operations and security and most of the time I was working on puppet I was doing infrastructure coding. I’m still learning on the job cause I missed the training for the puppet role because it was going to go to a software dev here originally.

It feels like using puppet to configure CIS benchmarks on our servers and to automate the installation of all this software seems like it’s a full time job, but I’m really not sure.

I’m on a 4 month trial splitting time between both until they figure it out how to handle my role.

Hello All, I hope somebody can help me with my issue. First time user of the "puppet-sssd" module. I have a simple manifest file in a Bolt project that meets the minimum requirements for SSSD to work (based on my reading so far), but when I apply the manifest with Bolt, it starts creating the sssd.conf file, but never finishes it, and then it fails to start the systemD service because no domain is available. But no domain is found in the sssd.conf file because it is not fully populated.