The Evolution of Puppet: Key Changes and Modernization Tips

The Evolution of Puppet: Key Changes and Modernization Tips

• 1.
  © Perforce Software,Inc. Puppet Evolution Key Changes and Modernization Tips David Sandilands Puppet Community and Developer Relationship Lead February 2025
• 2.
  © Perforce Software,Inc. • Puppet Development Kit (PDK) • Puppet VS Code extension Use the Right Tools • Dev tools and approaches from Vox Pupuli • AI like GitHub CoPilot (responsibly)
• 3.
  © Perforce Software,Inc. Packages • In 0.x versions of Puppet, some users found having too many package resources slowed everything down. • So they created repos where a profile could install a single package and pull all dependencies down.
• 4.
  © Perforce Software,Inc. Stages DON’T Just DON’T Typical early setups, replicating the flow of scripts. Makes maintenance and expansion hard.
• 5.
  © Perforce Software,Inc. site.pp and Module Defaults • Do not use style defaults outside of site.pp • Legacy style defaults "should occur only at the top scope in your site manifest … because resource defaults propagate through dynamic scope, which can have unpredictable effects far away from where the default was declared." • site.pp can create confusion
• 6.
  © Perforce Software,Inc. Data Types • Introduced during Puppet 4 2015, default to strict in Puppet 8 2023 • Validation and security • AI can be pretty good at putting in data types • Don’t forget an APL returning undef will error on Puppet 8
• 7.
  © Perforce Software,Inc. Overuse of Templates and Content • file_line was introduced in stdlib 2.1 in 2014 around about Puppet 3 • Before that, people used content/templates — or you battled with Augeas • A lot of things were just left hardcoded or unmanaged
• 8.
  © Perforce Software,Inc. params.pp • Before we got to Hiera 5 in 2016 with Puppet 5 • With hiera, we can simplify: • No inherit from another class • No need to use = operator • No case/ifs
• 9.
  © Perforce Software,Inc. Facts • Legacy facts were introduced in 2014 with the inclusion of Facter 2 in Puppet 3.2 • Finally removed (by default) in Puppet 8 • Use the facts['networking']['hostname’] instead of top scoped variables
• 10.
  © Perforce Software,Inc. Use the Full Features of Custom Facts • Most people right as simple script and leave it • Timeouts • Weighted resolutions • Confine and features • Rescue blocks
• 11.
  © Perforce Software,Inc. • augeas • cron • host • mount • scheduled_task • selboolean • selmodule Core Types Removed In Puppet 6 (2018), a number of core types were moved to modules. Make sure you add to Puppetfile and fixtures • ssh_authorized_key • sshkey • yumrepo • zfs • zone • zpool
• 12.
  © Perforce Software,Inc. Roles and Profiles • Way back in 2014, Gary Larizza first talked about roles and profiles • Gary always highlighted the idea that patterns weren’t supposed to be followed religiously
• 13.
  © Perforce Software,Inc. Move from ERB to ERP Templates • EPP v ERB • EPP is faster (due to only scoping facts needed) • EPP provides greater security as it has a limited scope and validates all data • ERB does not validate and drops non-existent variables • EPP comes with render and validate tools • EPP can process Sensitive without unwrapping • Watch out for voxpupuli/erb2epp
• 14.
  © Perforce Software,Inc. Sensitive Data • Keep your data secure throughout • EPP Use hiera-eyaml at rest in hiera • Use Sensitive data in the catalog • Use node_encrypt for transport
• 15.
  © Perforce Software,Inc. Sensitive Templates and Deferred Functions • Puppet 6.20 and later can evaluate Sensitive instead of having to unwrap in the template • As of Puppet 7.17 / 8, deferred functions are lazily evaluated
• 16.
  © Perforce Software,Inc. Trusted Facts and Commands • Introduced in Puppet 6.11 (2021) to access external data or make hiera and classification flexible • Check out puppetlabs/puppet-data-service on G itHub • Puppet Docs: Integration with External Data Provid ers
• 17.
  © Perforce Software,Inc. Lambdas • Inline templates or defined types were common before Puppet 4 • 17 functions create confusion • Just look at the most common • each 2799 • map 425 • filter 233 • reduce 141 • unique 168
• 18.
  © Perforce Software,Inc. Outdated Modules • Use the Forge Compatibility Report to check for outdated modules • Subscribe to individual modules to get notified when there's an update
• 19.
  © Perforce Software,Inc. Get Rid of Unused Code and Modules • voxpupuli/puppet-ghostbuster on GitHub
• 20.
  © Perforce Software,Inc. Testing and Debugging • At least add a compile test, PDK --add-tests • Enforce coverage completion • Use Onceover • Use AI responsibly