Learn Puppet - Puppet Enterprise (Console & Orchestration)

#Introduction

In episode 9 you got to know PuppetDB as the source of truth for run data. Puppet open source is powerful, but handling hundreds of nodes through the CLI alone gets tiring. In episode 10 we look at the complete product: Puppet Enterprise (PE), which brings puppetserver, PuppetDB, and all its supporting services under one roof with the Console as its graphical control center.

PE adds three big things on top of Puppet open source: a node classifier with node groups, RBAC for multi-user security, and orchestration for running tasks and plans at scale.

#Puppet Enterprise Components

PE isn't one big binary, but a set of interconnected services:

All these services are installed with a single installer. When it's done, you open the Console at https://<pe-console-host>:4433/console and log in with the admin account created during installation.

#Node Management and the Classifier

In the Console, the node list shows all nodes that have checked in, complete with environment, group, and last run status. Nodes can be classified in two ways: pinned manually to a node group, or selected through a rule.

Node groups are classification containers that can be arranged hierarchically. Child groups inherit classes from the parent group. Rules determine which nodes join automatically based on facts or certname:

{
  "rule": [
    "and",
    [ "=", "facts.os.family", "RedHat" ],
    [ "~", "certname", "^web\\d+\\.example\\.com$" ]
  ]
}

The rule above includes all RedHat nodes whose certname starts with web followed by digits. When a new agent checks in and its facts match, it joins the group immediately — no manual pinning.

Inside a node group, you can also set the environment and Hiera data directly from the Console, so the class + data combination per group is stored centrally.

#RBAC: Multi-User Security

RBAC (Role-Based Access Control) governs who can view and change what. Its components:

• Users — local accounts or connected to LDAP/AD.
• User groups — group users together.
• Roles — collections of permissions, for example operator, read-only, or admin.
• Permissions — specific actions like changing node groups, running tasks, or reading reports.

A user logging into the Console doesn't automatically have full access — access is granted through roles attached to user groups. This lets the ops team manage configuration while auditors can only read.

For automation, RBAC issues API tokens that scripts can use:

puppet access login --lifetime 1d \
  --service-url https://pe-console.example.com:4433/rbac-api/v1
puppet access show

#Reporting and Run Status

The Reports page shows the result of every run from all nodes: how many resources were changed, failed, skipped, and how many were already compliant (unchanged). The per-resource detail shows which property changes were made, complete with before and after values.

A node's run status is the health light of your infrastructure:

The combination of run status, report timestamps, and PuppetDB facts is your first triage when an incident happens: see which nodes failed, when they last checked in, and which resource is causing trouble.

#Puppet Tasks and Plans

PE brings push capabilities that don't exist in the pull-based agent model. Tasks are scripts run once across many nodes, while Plans are orchestration sequences that can call tasks, commands, even branching logic.

The simplest task is a script with metadata:

#!/bin/bash
systemctl restart nginx

{
  "description": "Restart layanan nginx",
  "input_method": "stdin",
  "parameters": {
    "version": {
      "type": "Optional[String[1]]",
      "description": "Versi yang ingin dilaporkan"
    }
  }
}

A plan combines several steps in one execution:

plan deploy::rolling_update(
  TargetSpec $targets,
  String[1] $version,
) {
  $batches = $targets.slice(2)
  $batches.each |$batch| {
    run_task('deploy::stop', $batch)
    run_task('deploy::start', $batch, version => $version)
    run_command('sleep 5', $batch)
  }
}

From the Console, the Tasks and Plans pages let you select target nodes with filters, then run a task or plan with parameters — all without writing a manifest. Each target's result is shown right in the UI.

#Conclusion

Puppet Enterprise polishes Puppet open source into a centralized platform ready for teams.

• The Console unifies classification, RBAC, reporting, and orchestration in one UI.
• Node groups and classifier rules automate who gets which configuration.
• RBAC secures multi-user access with users, groups, and roles.
• Reporting and run status are early detection for infrastructure health.
• Tasks and Plans add push power alongside the pull-based agent model.

That push power actually comes from a tool that also stands on its own — in episode 11 you'll learn Bolt & Orchestration: running bolt task run and plans against targets over SSH and WinRM, writing inventory.yaml, and combining Bolt for push actions with the Puppet agent for pull configuration. See you there!