Installing agents
Puppet Enterprise (PE) agent nodes monitor your infrastructure and help keep it in your desired state. You can install agents on *nix, Windows, and macOS nodes.
There are multiple ways to install agents. We recommend using the install script or installing agents from the console, and we have provided instructions for other cases, such as non-root agents, offline installation, and manually-transferred certificates. After installing agents, you must accept their certificate signing requests (CSRs).
You usually install agents from the PE package management repository on your primary server, which is created when you install your primary server. This repository serves packages over HTTPS using the same port as the primary server (port 8140). This means agent nodes don't require you to open any ports other than the one they already use to communicate with the primary server.
You can find agent packages on the primary server at
/opt/puppetlabs/server/data/packages/public/<PE VERSION>/
. This
directory contains the platform-specific repository file structure for agent packages. For
example, if your primary server runs on CentOS 7, in the
agent packages directory there is a directory named el-7-x86_64
. This
directory contains multiple subdirectories with the packages needed to install an
agent.
To install FIPS-enabled PE agents, install the appropriate FIPS-enabled agent on a third party supported platform with FIPS mode enabled. You can use FIPS-enabled agents with a non-FIPS enabled primary server.
After installing agents, you can edit node configuration settings in each node's puppet.conf
file at
/etc/puppetlabs/puppet/puppet.conf
. You can edit this file directly
or use the puppet config set
sub-command.
For example, to point an agent at a primary server called
primary.example.com
, run puppet config set server
primary.example.com
. This command adds server =
primary.example.com
to the main
section of the node's
puppet.conf
file.
The Puppet
Configuration Reference explains the configuration settings
you can specify in puppet.conf
.
All agent installation instructions assume your nodes use Supported operating systems.
-
Install agents with the install script
You can use the install script for *nix, Windows, and macOS nodes. The install script installs and configures the agent on target nodes using installation packages from the Puppet Enterprise (PE) package management repo. -
Install agents from the console
You can use the Puppet Enterprise (PE) console to install agents in *nix, macOS, and Windows nodes. -
Install *nix agents
You can install agents on *nix nodes with the install script, from the Puppet Enterprise (PE) console, with PE package management, your own package management, with or without internet access, and more. -
Install Windows agents
There are many ways you can install agents on Windows nodes, including PowerShell scripts, the Puppet Enterprise (PE) console, the MSI installer, and themsiexec
command. -
Install macOS agents
On macOS, agents have core Puppet functionality and platform-specific capabilities like package installation, LaunchD service management, System Profiler facts inventory, and directory services integration. You can install agents on macOS nodes with the install script, from the Puppet Enterprise (PE) console, from Finder, and more. -
Install non-root agents
You can configure non-root agents on *nix and Windows nodes. Running agents without root privileges allows teams to perform some, but not all, administrative actions in Puppet Enterprise (PE) that would otherwise require root privileges. -
Managing certificate signing requests
When you install a Puppet agent on a node, the agent must submit a certificate signing request (CSR) to the primary server, and you must accept the CSR to add the node to your Puppet Enterprise (PE) inventory. Accepting the CSR allows Puppet to run on the node and enforce your configuration, which in turn adds node information to PuppetDB and makes the node available throughout the PE console.