Puppet

Puppet is Perforce's configuration management tool for infrastructure teams. It enforces declared state on servers and network devices; the core is open source.

Puppet keeps a fleet of machines in the configuration its operators wrote down, and puts any machine that wanders back where it belongs. Luke Kanies created it in 2005 as an open source tool to replace manual configuration with infrastructure defined as code. Perforce Software has owned Puppet since 2022 and has extended its reach to servers, cloud, networks and edge devices. The problem it addresses is the hand-edited server that slowly diverges until it causes an outage, a security exposure or an audit finding. In Puppet Core, each resource describes the desired state of one part of a system, and the Puppet agent retrieves and applies its catalog on a schedule. A node that already matches reports no changes, and no-op mode simulates a new catalog without enforcing anything. Hiera holds the configuration data, with the eyaml backend keeping secrets encrypted. Puppet Forge supplies shared modules that a Puppetfile declares. Puppet Enterprise brings a web console with node run statuses, role-based access control and an Activity service that logs every run per node. It also reaches agentless nodes over SSH, WinRM or NETCONF, including switches and firewalls. Security Compliance Enforcement provides prebuilt modules aligned with CIS Benchmarks and DISA STIGs, and Enterprise Advanced adds data exports, vulnerability remediation and AI features powered by Perforce Intelligence. Puppet is built for infrastructure and platform teams whose estates mix Linux and Windows servers, cloud accounts and network gear. Regulated organizations in government, healthcare and finance use it to keep compliance in force between assessments rather than proving it only during them. It also suits estates that stay on premises, sit behind an air gap or run in sovereign environments. Teams already running Open Source Puppet can move to Puppet Core for hardened, vendor-built packages and support. Larger estates that need central control and access rules choose Puppet Enterprise. Administrators reach for Puppet to harden servers against a benchmark, roll out patches as code and check a change in no-op mode before it lands. Puppet code lives in Git and reaches the servers through Code Manager or r10k. Operators sign in through SAML or LDAP directories such as Okta and Microsoft ADFS. When an auditor asks what changed on a single server and who changed it, the answer sits on that node's Activity tab.