These instructions cover installing Puppet agent on macOS machines.
- Make sure you’re ready.
Note: If you’ve used older Puppet versions, Puppet 4 changed the locations for a lot of the most important files and directories. See this page for a summary of the changes.
Download the macOS
puppet-agentpackage specific to your version of macOS.
puppet-agentpackage bundles all of Puppet’s prerequisites, so you don’t need to download anything else to install Puppet on an agent node.
OS X packages are named according to their
puppet-agentversion and compatible OS X version:
puppet-agent-<PACKAGE VERSION>.osx<OS X VERSION>.dmg
To see which versions of Puppet and its related tools and components are in a given
puppet-agentrelease, as well as release notes for each release, see About Puppet agent.
Previous package names
We used some different naming schemes in the puppet-agent 1.2 series before settling on the current convention in 1.2.5.
- 1.2.0 through 1.2.2:
puppet-agent-<VERSION>-osx-<OS X VERSION>-<ARCH>.dmg. Redundant; OS X only runs on x86_64.
puppet-agent-<VERSION>-<OS X CODE NAME>.dmg. This was too hard for automated tooling to deal with, because OS X’s built-in CLI tools don’t report the code name.
- 1.2.0 through 1.2.2:
Make sure you can run Puppet executables.
The new location for Puppet’s executables is
/opt/puppetlabs/bin/, which is not in your
PATH environment variable by default.
This doesn’t matter for Puppet services, so enabling or disabling Puppet agent with
launchctl works fine. However, if you’re running any interactive
puppet commands, you need to either add the location to your
PATH or refer to the executables by their full locations.
For more information, see our page about files and directories moved in Puppet 4.
There are three ways to install Puppet on OS X:
- With the GUI installer.
- On the command line.
- With Puppet (if upgrading).
Regardless which you choose, installing the package will start the
mcollectiveservices. You can later disable these services with
sudo puppet resource service <NAME> ensure=stopped enable=false.
Installing with the GUI:
puppet-agentdisk image you downloaded. This mounts it at
/Volumes/<DMG NAME>. A Finder window appears showing the disk’s contents: a single
Double-click the package file, and follow the installer prompts to install it. When installation finishes, Puppet agent and MCollective will be running.
After installing, unmount and delete the disk image.
Installing on the command line:
Alternately, you can use the
installercommands to mount the disk image and install the package from the command line.
Mount the disk image by running
sudo hdiutil mount <DMG FILE>.
.pkgfile in the mounted volume and install it by running
sudo installer -pkg /Volumes/<IMAGE>/<PKG FILE> -target /.
When installation finishes, Puppet agent and MCollective will be running.
After installing, run
sudo hdiutil unmount /Volumes/<IMAGE>to unmount the disk image.
Optionally, you can then delete the
Upgrading with Puppet:
Puppet includes a
packageresource provider for macOS that can install
.pkgfiles from a disk image. If you already have Puppet installed, you can use the
puppet resourcecommand to upgrade with fewer steps.
Locate the disk image you downloaded, and note both the filename and its full path on disk. Then, run:
sudo puppet resource package "<NAME>.dmg" ensure=present source=<FULL PATH TO DMG>
Configure critical agent settings
You probably want to set the
serversetting to your master’s hostname. The default value is
server = puppet, so if your master is reachable at that address, you can skip this.
For other settings you might want to change, see the list of agent-related settings.
Sign certificates (on the CA master)
As each agent runs for the first time, it will submit a certificate signing request (CSR) to the certificate authority (CA) Puppet master. You’ll need to log into that server to check for certs and sign them.
sudo /opt/puppetlabs/bin/puppet cert listto see any outstanding requests.
sudo /opt/puppetlabs/bin/puppet cert sign <NAME>to sign a request.
After an agent’s certificate is signed, it regularly fetches and applies configurations from the Puppet master.