Learn Puppet - Latest Stable Features (Puppet 8 & PE 2025)

#Introduction

In episode 19 you mastered the operational side: analyzing agent run performance, tuning Puppet Server on the JVM side, and handling various common errors in the field. Those skills stay relevant across versions, but the Puppet ecosystem keeps moving forward — and newer versions bring changes you must understand.

Being a mature Puppet engineer isn't only about mastering old versions; it's also about following the direction of the tooling. This episode covers the latest stable features on the two distribution tracks: Puppet 8 open source with the Ruby 3.3 runtime and built-in UTF-8 encoding, and Puppet Enterprise 2025.1 with Security Compliance Management, role-based node management, and a new approach to compliance.

#Two Distribution Tracks

Puppet is available in two main forms:

Both share the same DSL language, agent, and modules — code you write on OSS can move to PE with little change.

#What's New in Puppet 8

Puppet 8 is the latest open source release of the Puppet Platform 8 line, replacing Puppet 7. Some of its fundamental changes:

#Ruby 3.3 Runtime Without System Dependencies

Starting with Puppet 8, the agent and server packages bundle their own Ruby, so they no longer depend on the system Ruby. The runtime version keeps rising — Puppet 8.8 and later releases are tested against Ruby 3.3. The consequence: custom facts, types, and providers you write must run on this new runtime.

/opt/puppetlabs/puppet/bin/ruby --version
puppet --version

#UTF-8 Encoding by Default

Previously, the default encoding could vary depending on the system locale, which made custom facts or templates misbehave with non-ASCII characters. In Puppet 8, Ruby uses UTF-8 as the default external encoding, so string processing is more consistent across operating systems — including Windows, which previously used a specific code page.

This change mainly affects facts and providers that parse text. If you have a custom fact that forces a specific encoding, it's usually no longer necessary — but still revalidate it in your environment.

#Modern Module Tooling and PDK

Module development is increasingly moving toward PDK, the Puppet Development Kit. The modern workflow: pdk new module, then manage dependencies via the Puppetfile and install with r10k or Code Manager:

pdk new module nginx
cd nginx
pdk validate
pdk test unit

The puppet module command in Puppet 8 has also been reworked to use a more modern Forge API, with better dependency resolution than previous versions.

#Deprecations and Removals

A few things to note when upgrading to Puppet 8:

#Puppet Enterprise 2025.1

Puppet Enterprise 2025.1 is an example of the latest regular release in the PE 2025.x line. For teams needing long-term stability, Puppet also maintains the 2023.8 LTS track with longer support — and both remain free to run for up to 10 nodes.

#Security Compliance Management

One of the most talked-about features in PE 2025.1 is Security Compliance Management. In PE, the abbreviation SCM refers to the compliance capability formerly known as Puppet Comply. SCM scans PE-managed nodes against CIS Benchmarks, shows compliance status on the dashboard, and suggests remediations.

SCM doesn't just show reports; it integrates with role management so different teams — for example platform, security, and operations teams — get visibility and control matching their respective responsibilities.

#Role-Based Node Management

PE 2025.1 strengthens how nodes are grouped and classified. Instead of attaching classes one by one to individual nodes, you can define roles — a combination of node groups, classes, and variables — then assign nodes to those roles. This model aligns closely with the Roles/Profiles pattern we learned in episode 5:

class role::web_server {
  include profile::base
  include profile::nginx
  include profile::app
}

With integrated RBAC, granting access is also role-based: an engineer can be given rights to run orchestration on a specific node group without being given access to the whole console.

#More Modern Compliance and Patching

PE 2025.1 also brings several operational services together under a more cohesive umbrella:

For teams wanting to move to a policy-as-code model, the SCM and SCE combination allows compliance to be measured and enforced continuously — not just as an annual audit checklist.

#A Safe Upgrade Path

Whether moving from Puppet 7 to Puppet 8, or from an old PE version to PE 2025.1, follow these principles:

puppet --version
puppetserver --version
puppet config print server

Test incrementally: upgrade one staging server, run agents on a few nodes, then watch the reports and logs. Keep hiera data and modules under version management so rollback is always possible.

#Conclusion

In this episode we reviewed the latest developments in the Puppet ecosystem: Puppet 8 open source with the Ruby 3.3 runtime, built-in UTF-8 encoding, modern puppet module and PDK tooling, and the deprecation list to note when upgrading. On the enterprise side, we covered Puppet Enterprise 2025.1 with Security Compliance Management, role-based node management, and a more modern compliance model.

Key takeaways:

• Know your distribution track — OSS for flexibility, PE for operational convenience and compliance.
• Understand the new runtime — bundled Ruby and built-in UTF-8 affect custom facts, types, and providers.
• Follow the deprecations — read the release notes before upgrading and test Forge modules against new versions.
• Adopt roles, not nodes — the role-based node management model aligns with the Roles/Profiles pattern.
• Make compliance code — SCM to measure, SCE to enforce.

In the next episode, episode 21, we'll cover Production-Ready Architecture — a Puppet architecture at the thousand-node scale: high availability, PuppetDB on PostgreSQL, Code Manager, canary environments, and monitoring and backup. See you in the next episode!