What's New in Puppet

READ RELEASE NOTES

Puppet 2023.0 is the latest release following 2021.7, now using updated versioning. It’s a backward-compatible release that contains enhancements and resolved issues from our previous major release.

Here are the highlights of Puppet Enterprise 2023.0:

• NIST compliance: Puppet 2023.0 ensures that sensitive information is cleared when a session times out. You can customize the timeout to specify a default value and issue a confirmation message. In this way, you reduce compliance risk for InfoSecOps and administrators. This feature is designed for compliance with National Institute of Standards and Technology (NIST) guidelines. 

• Authenticate users in multiple Lightweight Directory Access Protocol (LDAP) domains: Use a prioritized list of LDAP servers to get credentials. In this way, you reduce compliance risk and increase operational efficiency for administrators. 

• Streamlined user interface for tasks and plans: Increase observability, throughput, fault tolerance, and operational efficiency with new job and task queue status, task concurrency fine-tuning, default job timeouts, and the capability to stop stalled jobs. View and edit task parameters, targets, and other details. The new functionality is designed to benefit users, operators, and managers. 

• Scalability performance improvements to deploy and manage more nodes: Increase operational efficiency and accelerate time to value with new orchestrator task concurrency defaults and improvements. Reporting, database performance, and agent certificate regeneration improvements are provided as well to benefit all users. 

Component Updates 

• Java 17

Deprecations

Removed primary server platforms:

• CentOS 8

Removed agent platforms:

• CentOS 8 
• Debian 9 
• Fedora 32 
• Fedora 34 
• Ubuntu 16.04

Removed patch management platforms:

• Debian 9 
• Fedora 34

READ RELEASE NOTES

• Multiple resolved issues
• Security fixes:
  • CVE-2022-41946 
  • CVE-2022-41404 

READ RELEASE NOTES

• Inclusion of Facter 4
• Inclusion of Ruby 2.7
• Definition of locations for storing sensitive data
• Removal of harmful terminology from the Puppet platform 
• Removal of several Win32 gems to consolidate Windows functionalities
• Environment and Fact caching
• Iterable data type supplants Enumerable data type
• Removal of legacy code
• Added Postgres 11+ requirement
• PuppetDB migration to new HTTP client

READ RELEASE NOTES

• New and revamped filters support more advanced queries
• Target specific sets of infrastructure data with compound filters

READ ANNOUNCEMENT

• New tracked metrics for Puppet Server, PuppetDB, and Orchestrator
  • Performance and workload metrics allow for better troubleshooting of performance issues
• Replaced default dashboards to visualize new metrics

• Lockless code deploy, stable since version 2021.2, is now no longer an experimental feature, preventing code deploys from blocking catalog compilation
• PE orchestrator plans and code deployments can now be run concurrently without interruption
• Primary server support: FIPS-compliant RHEL 8, SLES 15, Ubuntu 20.04; Client support: macOS 12 (x86); TLS 1.3 support added

• Optimized disk utilization for HA deployments 
• Amazon Linux 2 support for primary server deployment
• Patch management available for Amazon Linux 2 managed nodes 

• Modify Role-Based Access Control (RBAC) parameters via API 
• Sequential patching option allows for systems in a patch group to reboot one at a time rather than simultaneously 
• PuppetDB best-practices-based maintenance tasks are enabled by default 

• Code manager now supports authentication to custom servers 
• Puppet metrics collector module is now included in PE, which collects Puppet metrics by default and gives insight into infrastructure performance 
• PE_databases module is now included in PE and provides tuning, maintenance, and backups for PE PostgresSQL 

• Export data in shareable format from task runs to CSV 
• Platform support for Puppet agent additions: macOS, Red Hat Enterprise Linux 8 ppc64le, Ubuntu 20.04. aarch64, Fedora 34 
• Resolved critical CVE-2021-27021 

• Setup single sign-on (SSO) and multi-factor authentication (MFA) with SAML 2.0 support 
• Added password complexity requirements for additional application security 
• Orchestrate pre and post patching steps including: health checks, pre and post command hooks and server reboots, all with a patching Plan, 
• Save custom defaults for the Value Report to tailor reporting needs 
• Query performance updates to PuppetDB 
• Puppet 2021.1 ships with Puppet 7 

• Lockless code deploy, stable since version 2019.8.6, is now no longer an experimental feature, preventing code deploys from blocking catalog compilation 
• PE orchestrator plans and code deployments can now be run concurrently without interruption 
• Primary server support: FIPS-compliant RHEL 8, SLES 15, Ubuntu 20.04; Client support: macOS 12 (x86); TLS 1.3 support added 

• Patch management available for Amazon Linux 2 managed nodes 
• Optimized disk utilization for HA deployments 

• Sequential patching option allows for systems in a patch group to reboot one at a time rather than simultaneously 
• PE support script enhancements 

• PuppetDB maintenance module installed by default 
• Code Manager deployment performance improvements 

• Update Certificate Revocation List (CRL) via API 
• Export results of task jobs to CSV 

• Customize values used to derive value report results 
• Configurable Certificate Revocation List (CRL) auto-refresh interval 

• New patching plan that includes pre- and post-patching health checks to reduce manual steps during the patching process. 
• Performance improvements to PuppetDB. 

• Updates the PostgreSQL version to address security vulnerabilities 

• Harmful terminology deprecations and removals 
• Plans in PE improvements including scheduling plans and sensitive parameter support 
• Patching improvements including the ability to re-run tasks or jobs on failed nodes and know the patch status per node after patching task 
• Activity Service improvements that report on all activities done in the console 
• Installer upgrade improvements 
• Notification of CA certificates when they are close to expiring from the PE Console 
• PE Value Report builds on the value API in PE 2019.8.1 and gathers real-time data and calculates time reclaimed per automation type. 

• This version was never released. 

• Value reporting API reports details about automated changes that PE makes to nodes, and provides an estimate of time freed by each type of change based on intelligent defaults or values you provide. 
• Console navigation and workflow improvements including new sections and renamed pages 
• Select plan parameters that are boolean or enum types from a drop down menu in the Value field. 
• Updates to metrics endpoints are now controlled by trapperkeeper-authorization and configured in the Puppet Serverauth.conf file. 

• Integrate existing Puppet code into plans 
• Patch systems with Puppet, allowing organizations to consolidate tooling 
• Use less hardware with PE performance improvements 
• Seamlessly scale up and bring more nodes under management 
• Onboard new team members to a streamlined, modern product UI 

• Improvements to plan functionality in Puppet Enterprise (parameters exposed in PE console) 
• Improved PE architecture with horizontally scaled PuppetDB on compilers 
• Improved speed and reliability for provisioning a PE replica 
• Upgrade all compilers with a single command 

• This version was never released 

• Resolved a high-severity vulnerability CVE-2020-7943 

• Puppet Enterprise console enhancements 
• Inventory page revamp (each installation type has a button that links to its own page, more help icons and definitions) 
• Plans event view in the Job details page now displays an output message for each plan run 
• Two new API endpoints for Code Manager provide greater flexibility in deploying modules 

• Custom PQL queries in the console for running Puppet and tasks 
• New Run drop down menu so you can run Puppet or a task for the nodes listed on the current page 
• Ability to select code environment for tasks and plans (other than “production”) 

• Support for managing network devices with Puppet Enterprise 
• Support for running plans from console and CLI 
• Agent installation from the console (via Inventory option) 

• Schedule recurring tasks via Puppet Enterprise console 
• Add nodes without agents to Puppet Enterprise (new Inventory option on the console) 

• Agentless tasks via SSH (Linux) (2019.0.0) 
• Agentless tasks via WinRM (Windows) (2019.0.1) 
• Express installation (2019.0.2) 

• Continuous Delivery for Puppet Enterprise console installation (module via console) 

• Schedule tasks in Puppet Enterprise console 

• Role-based access to tasks 
• Puppet Discovery (retired) 

• Hiera overrides in the console (set parameters on node groups without declaring the class) 
• Ad-hoc tasks (run tasks from the console, on the command line, or by the orchestrator API) 
• AWS OpsWorks for Puppet Enterprise (offers cloud-focused workflows and managed service capabilities for running Puppet Enterprise on AWS) 

• Orchestrator in the console (create node lists, either static or using Puppet Query Language, on which to run Puppet) 
• Packages inventory in the console 

• Hiera 5 
  • Improved performance 
  • True environment- and module-level data