Puppet
The declarative configuration-management veteran: agents continuously converge servers toward a cataloged desired state — still ruling large regulated fleets.
What is Puppet?
Puppet manages server configuration declaratively: you describe desired state in its Ruby-derived DSL — packages present, files templated, services running — agents check in with a Puppet server every 30 minutes, receive a compiled catalog, and converge the node toward it. That continuous-enforcement loop is Puppet’s signature: manual drift gets reverted on the next run, making config drift a transient rather than a slow rot. Facter feeds node facts into compilation; Hiera separates data from code; PuppetDB makes fleet state queryable — “which servers still run OpenSSL X?” is one query.
Puppet versus Ansible — the enduring fork
Ansible is push-based, agentless (SSH), procedural-ish, trivial to start; Puppet is pull-based, agentful, model-driven, heavier to bootstrap but stronger at enforcing state across thousands of nodes forever. The practical split: ad-hoc orchestration and small-to-mid fleets lean Ansible; large regulated estates that must prove configuration compliance continuously (the PuppetDB + enforcement-loop audit story) are where Puppet retains real gravity. Ordering is Puppet’s classic gotcha — resources apply in dependency order, not file order; forgotten require/notify relationships create heisenbug catalogs that pass in dev.
The strategic context
Immutable infrastructure shrank config management’s kingdom: baked images, containers, and Kubernetes mean fewer long-lived mutable servers to converge, and Terraform-style IaC took the provisioning layer. Puppet’s remaining stronghold is exactly the estate that isn’t going immutable — large VM fleets, compliance-bound enterprises, the OS layer under everything else.
What people get wrong
- Treating it as provisioning — Puppet configures machines that exist; creating them is IaC’s job.
- Skipping environments/r10k workflows: testing catalog changes in production because branching felt optional.
- Assuming file order equals run order — the dependency-graph lesson everyone learns via outage.
Primary source: Puppet documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.