What's New in Puppet

SCE FOR LINUX RELEASE NOTES   DEMO SECURITY COMPLIANCE ENFORCEMENT

December 10, 2024

This release of Security Compliance Enforcement (SCE) for Linux discontinues support for CentOS 7, which reached EOL in June 2024. Also included are issue resolutions to help ensure that chrony time synchronization works as designed on Ubuntu Linux 20.04.

Updated in this release:

• Discontinued support for CentOS 7: The end of community support for CentOS 7 was announced in December 2020, and it reached EOL in June 2024. This release of SCE for Linux discontinues support for the operating system.
  • If you plan to transition to a different OS with a different CIS Benchmark, you might have to update the configuration to avoid operational issues.

Issues resolved in this release:

• Resolved several issues from SCE for Linux 2.2.1 related to chrony time synchronization on Ubuntu Linux 20.04. Head to the full SCE for Linux 2.3.0 release notes for a full list of issues resolved.
• Resolved an issue related to the GnuTLS Transport Layer Security Library in which the exec resource sce_gnutls_version was unnecessarily enforced during each Puppet run.

SCE FOR LINUX RELEASE NOTES   DEMO SECURITY COMPLIANCE ENFORCEMENT

October 15, 2024

This release of Security Compliance Enforcement (SCE) for Linux enables users to enforce a greater degree of security on Ubuntu Linux 22.04 using CIS Benchmark Level 2 profiles. Users of DISA STIG controls can meet an updated standard for Red Hat Enterprise Linux (RHEL) 8.  

New in this release:

• Added support for the latest CIS Benchmarks for the following operating systems:
  • Ubuntu Linux 22.04, v2.0.0, Level 2 – Server
  • Ubuntu Linux 20.04, v2.0.1, Level 2 – Server
• Added support for updated DISA STIG on the following operating system:
  • Upgraded RHEL 8 STIG from Version 1, Release 11 to RHEL 8 STIG Version 1, Release 14.
• Hiera Automatic Parameter Lookup (APL) can now be used to override any parameter implemented by a resource used by SCE for Linux.
• Usability improvements were implemented for the Bolt plan linux_users_and_groups, which is used to enforce user-specific and group-specific security settings on all applicable users and groups in a system.

Issues resolved in this release:

• Resolved an issue related to audit log file permissions, bringing them in line with the management method for all other files in the /var/log/audit directory.
• Resolved a password issue on RHEL 8 operating systems.
• Resolved compilation errors sometimes seen by users running SCE for Linux with Puppet Enterprise 2021.7.8 and 2021.7.9.
• Resolved an issue that was causing scan failures related to the Gnome Desktop Manager (GDM) banner message.

PUPPET ENTERPRISE ADVANCED DEMO

September 19, 2024

With the addition of two exclusive, value-adding capabilities, Puppet Enterprise Advanced remains the best way to get the most out of your infrastructure with Puppet. This simultaneous release of the Observability Data Connector and the enhanced ServiceNow Spoke delivers more value for Puppet Enterprise Advanced users, giving them access to improved monitoring and resource optimization, faster issue resolution, predefined and custom self-service automation workflows, and more.

For more information on adding these capabilities to your Puppet Enterprise entitlement, visit the Puppet Enterprise Advanced product page or compare plans on the Puppet Pricing & Plans page.

Observability Data Connector

The Observability Data Connector module, available exclusively to Puppet Enterprise Advanced customers, lets Puppet admins skip the wait and see specific events as they happen. Import key Puppet data into your preferred observability platforms — like Splunk, Data Dog, New Relic, Prometheus, and Grafana — instead of adding yet another tool to their tech stack. Importable data includes:

• Puppet event totals: Shows how many of each event type happened during a report from changed resources to failed resources. Users can use this data to look for issues, identify anomalies, and confirm change consistency between states, environments, and resources.  
• Puppet catalog times: Shows the timing of each stage of a Puppet catalog application. This function allows you to see which stages of your catalog are taking the most time so you can identify coding issues early and better manage infrastructure capacity.

Self-Service Automation via the ServiceNow Spoke

The Puppet Spoke for ServiceNow gives platform teams the power to automate without leaving ServiceNow, one of the most popular IT service management platforms (ITSMs) on the market. Select from a number of templated items or create custom automation workflows for your whole team and execute Puppet Tasks and Plans with a click.

This exclusive feature empowers platform teams using Puppet Enterprise Advanced to manage IT infrastructure changes efficiently, troubleshoot problems quickly, and resolve more incidents faster. With the Puppet ServiceNow Spoke, teams have access to:

• Pre-built ServiceNow catalog items: This integration provides a set of pre-defined workflows in the ServiceNow catalog. These template items include routine Puppet tasks like installing the Puppet agent on a node, rebooting a machine, running a package install, managing a service, and more.
• Custom ServiceNow catalog items:  With the Puppet Spoke, your teams can also make custom Puppet workflows accessible to non-experts for easy, self-service consumption without needing to log into the Puppet Enterprise console.

The Data Connector and the ServiceNow Spoke are available immediately to Puppet Enterprise Advanced users. At this point, these capabilities cannot be bought individually or applied to other Puppet entitlements, and are only available to Puppet Enterprise Advanced customers.

2023.8.0 LTS RELEASE NOTES   2021.7.9 LTS RELEASE NOTES   DEMO PUPPET ENTERPRISE

August 2024

Puppet Enterprise 2023.8.0 LTS

The first LTS release built on Puppet 8, 2023.8.0 LTS is designed to support your long-term success with Puppet, featuring improvements to performance, scalability, and security to help your teams automate and manage infrastructure more efficiently.

Whether upgrading from 2021.x LTS or implementing Puppet Enterprise for the first time, Puppet Enterprise 2023 LTS is your gateway to a more robust and secure infrastructure.

Puppet Enterprise 2023.8.0 LTS is the inaugural release of the 2023.x LTS track, which will replace the 2021.x LTS release track after 2021.7.9.

Puppet Enterprise 2021.7.9 LTS

Alongside the release of our 2023.8.0 LTS, we are also releasing the final version of the 2021.x LTS release track with Puppet Enterprise 2021.7.9. While this version will get security updates and remain supported for the next 6 months, this will be the last major update for this version. In future releases of Puppet Enterprise LTS, the 2021.x LTS release track will be replaced by the 2023.x LTS release track.

In order to continue using the latest version of Puppet Enterprise LTS beyond 2021.7.9, you will need to upgrade to the 2023.x release track.

For information about upgrading to Puppet Enterprise 2023 LTS, see the Puppet documentation on upgrading Puppet Enterprise.

New in Puppet Enterprise 2023.8.0 LTS:

• Puppet 8: This release is built on top of Puppet 8, and enhances automation capabilities, offering improved efficiency and security in managing your infrastructure. A complete list of features and improvements contained in Puppet 8 can be found here.
• Improved performance and scalability: Various improvements have been made to our components and services to help improve operational performance and scalability. These include improvements to lockless deploys for Code Manager, PuppetDB, and Orchestrator.
• Improved DR capabilities: We understand the critical nature of maintaining business continuity and have improved the resiliency of promotion and provision actions to help support better disaster recovery processes.
• Updated agent support: This release also adds agent support for the following operating systems:
  • Ubuntu 24.04 (amd64 and aarch64)  
  • RedHat Enterprise Linux 9 ppc64le  
  • Alma Linux 9 (x86_64 and aarch64)  
  • Rock Linux 9 (x86_64 and aarch64)  
  • Amazon Linux 2 (aarch64)  
  • Fedora 40 (x86_64)

Issues resolved in Puppet Enterprise 2023.8.0 LTS:

This release also contains a variety of bug fixes alongside dependency and security updates. A complete list of changes can be found in the 2023.8.0 release notes here.

EOL for Several Primary Server Platforms

In Puppet Enterprise 2023.8.0 LTS, we've removed support for the following End of Life (EOL) operating systems as infrastructure servers (Primary, Replica, Compiler, or Database) platforms:

• CentOS version 7
• Oracle Linux version 7
• Red Hat Enterprise Linux version 7
• Red Hat Enterprise Linux (FIPS 140-2 compliant) version 7
• Scientific Linux version 7
• Ubuntu 18.04
• SuSE Linux Enterprise Server (SLES) 12

New in Puppet Enterprise 2021.7.9 LTS:

• Legacy facts disabled by default: This ensures that your code base is compatible with Puppet 8 and that there are no issues or blockers with your upgrade path.
• Disabling slow and I/O intensive operation codedirs chown in compiler catalogs.
• Faster Events screen load in the Puppet Enterprise console shows events in the last 30 minutes.
• Updated agent support: This release also adds agent support for the following operating systems:
  • Ubuntu 24.04 (amd64 and aarch64)  
  • RedHat Enterprise Linux 9 ppc64le  
  • Alma Linux 9 (x86_64 and aarch64)  
  • Rock Linux 9 (x86_64 and aarch64)  
  • Amazon Linux 2 (aarch64)  
  • Fedora 40 (x86_64)

RELEASE NOTES   ADD SECURITY COMPLIANCE ENFORCEMENT

Aug. 13, 2024

This release of Security Compliance Enforcement for Linux allows for enforcement of security hardening controls on a broader range of operating systems, including enforcement of the latest CIS Benchmarks on key OSes. Other updates let you fine-tune which security controls are enforced without splitting them across multiple configurations.

New in this release:

• Added support for the latest CIS Benchmarks for the following operating systems:
  • CIS AlmaLinux 9 Benchmark v1.0.0 is now supported at Server Levels 1 and 2.
  • CIS Rocky Linux 9 Benchmark v1.0.0 is now supported at Server Levels 1 and 2.
  • CIS Ubuntu 22.04 Benchmark v2.0.0 is now supported at Server Level 1.  
  • CIS RHEL 7 Benchmark v4.0.0 is now supported at Server Levels 1 and 2.
  • CIS Oracle Linux 7 Benchmark v4.0.0 is now supported at Server Levels 1 and 2.
• Increased flexibility when specifying which CIS or STIG controls to enforce. Starting with 2.1.0, you can apply both the only and ignore keys in a single configuration file. For example, if you have a list of 100 controls and use the only key to select 50 of them, you can then use the ignore key to exclude certain controls from those 50, giving you more precise control over which security rules are enforced.

Issues resolved in this release:

• Resolved an issue that generated error messages about dependency cycles when configuring custom firewall rules.
• Resolved an issue where specified audit permissions were applied only to .conf files in the etc/audit directory, rather than all configuration files in the etc/audit directory and subdirectories.
• Fixed a defect that could disrupt SSH connectivity on some nodes.
• Fixed an audit rule issue that caused Puppet run failures in rare circumstances. Now, if the find command fails, error messages are sent to the puppetserver log, but the Puppet run continues and other controls are enforced.

RELEASE NOTES   DEMO PUPPET ENTERPRISE

Aug. 16, 2024

This release of Security Compliance Management includes an enhancement that improves reliability, accuracy, and scalability of scheduled scans when onboarding new nodes to Puppet. Additionally, an update to the user experience improves flexibility by permitting the modification of key settings (including inventory refresh intervals and data retention settings) anytime versus only during installation, allowing for more efficient management.

This release also includes CIS Benchmark updates, fixes for a known issue, and an update to address a critical vulnerability in an open-source identity and access management (IAM) tool leveraged by Puppet.

(Release notes for the functionally equivalent Puppet Comply 2.22.0 can be found here.)

New in this release:  

• Dynamically target nodes for scheduled scans: This timesaving feature removes the manual effort of editing scheduled scans whenever new nodes are onboarded. Now, when scheduling scans in the Security Compliance Management Console, customers can target nodes dynamically by specifying the node groups to scan, so that scans run automatically on all nodes that belong to the specified node groups at the scheduled times.
• Configure the inventory refresh and data retention settings: This enhancement gives more flexibility and control to our customers. Previously, inventory refresh intervals and data retention settings were configurable only during the installation process. Now, to improve user experience, the Settings page in the Security Compliance Management Console allows customers to adjust these two settings at any time.
• Inclusion of CIS-CAT® Pro Assessor v4.43.0 (released July 11, 2024).
  • Security Compliance Management is regularly updated with the latest version of the CIS-CAT Pro Assessor, which assesses system compliance with CIS Benchmarks to generate actionable insights.
• Added support for the latest CIS Benchmarks for the following operating systems:
  • Apple macOS 12.0 Monterey Benchmark v3.1.0
  • Apple macOS 13.0 Ventura Benchmark v2.1.0
  • Microsoft Windows Server 2019 Stand-alone v2.0.0
  • Oracle Linux 9 Benchmark v2.0.0
  • Red Hat Enterprise Linux (RHEL) 9 Benchmark v2.0.0

Issues resolved in this release:

• Fixed a bug that could prevent node selection when creating an ad hoc desired compliance scan.

Security fixes in this release:

• Resolved the following CVE:
  • Upgraded KeyCloak to v25 to address CVE-2023-2976.

RELEASE NOTES   DEMO PUPPET ENTERPRISE

June 27, 2024

With this release of Security Compliance Management (formerly Puppet Comply), Puppet Enterprise users can now set their desired compliance defaults for each operating system (OS), saving valuable time when adding new nodes to a common OS.

We’ve added instructions for performing data backups and a guided tutorial for conducting ad hoc scans using the REST API available with Security Compliance Management. This release also includes CIS Benchmark updates, fixes for several known issues, and security updates.

New in this release:  

• Desired compliance can be set for operating systems. Any node added to that OS will automatically be assigned the default benchmark and profile you set for that OS.
• Added instructions on data backup: Security Compliance Management now includes instructions for backing up your data to make it easier to restore systems in a disaster recovery scenario.
• REST API tutorial: A new tutorial guides users through running an ad hoc scan in Security Compliance Management using the REST API added in 2.18.0.
• journald logging instructions: Added instructions on how to access relevant log files with the journald logging driver.  
• Inclusion of CIS-CAT® Pro Assessor v4.42.0 (released May 30, 2024).
  • Security Compliance Management is regularly updated with the latest version of the CIS-CAT Pro Assessor, which assesses system compliance with CIS Benchmarks to generate actionable insights.
• Added support for the latest CIS Benchmarks for the following operating systems:
  • Debian Linux 12 Benchmark v1.0.1
  • Microsoft Windows 11 Stand-alone Benchmark v3.0.0
  • Microsoft Windows Server 2019 Benchmark v3.0.1

Issues resolved in this release:

• Fixed an issue that could prevent existing scheduled scans from running after migrating from Security Compliance Management version 2.x to 3.x.
• Fixed an issue where the search box on the exceptions page wouldn’t accept input.
• Fixed an issue that was causing macOS nodes to be listed as Darwin on the Inventory page, which prevented the desired compliance from being set for those nodes.

Security fixes in this release:

• Resolved the following CVEs:
  • Updated braces to address CVE-2024-4068
  • Updated KeyCloak to address CVE-2024-2961, CVE-2024-33599, CVE-2024-2700, CVE-2024-1132, CVE-2024-1249, CVE-2024-2419, CVE-2024-3656, GHSA-69fp-7c8p-crjr
  • Updated oauth2-proxy to address CVE-2023-5363

RELEASE NOTES

May 21, 2024

In today’s operating reality, organizations need more value from the tools they’re already using. This release adds more features and functionality to Puppet Enterprise to help users do more with their infrastructure, faster and more securely.

With the release of Puppet Enterprise 2023.7, the inclusion of Continuous Delivery lets customers build, test, and deploy Puppet code. Security Compliance Management provides compliance scanning, assessment, and monitoring capabilities within Puppet, using Puppet infrastructure as code to measure security and compliance posture against custom policies and the integrated CIS-CAT® Pro Assessor for maximum compliance visibility.

Additionally, Puppet Enterprise 2023.7 adds previews of premium features to the Puppet Enterprise Console. Get a sneak peek at Impact Analysis (which lets you preview the impact of your next code change on existing configurations before you merge) and Security Compliance Enforcement (policy as code for correcting drift and enforcing desired state configurations hardened against CIS Benchmarks and DISA STIGs) and learn more with new links in the Puppet Enterprise Console.

Puppet Enterprise 2023.7 also includes additional agent support, bug fixes, and security updates to ensure smoother operations, consistent infrastructure uptime, and maximum usability of Puppet Enterprise.

New in this release:

• Security Compliance Management is now included with Puppet Enterprise, adding compliance monitoring and assessment insights as part of the same Puppet Enterprise license.
• Continuous Delivery is now included with Puppet Enterprise, adding CI/CD capabilities that let you build, test, promote, and deploy Puppet code and integrate with your current pipelines as part of the same Puppet Enterprise license.
  • Security Compliance Management and Continuous Delivery can be accessed from Puppet Enterprise. Users can launch the new consoles by clicking quick links in the Puppet Enterprise console.
• Added agent support for the following operating systems:
  • Amazon Linux 2023 amd64
  • Amazon Linux 2023 aarch64
  • Debian 11 aarch64
  • Debian 12 amd64
  • Debian 12 aarch64
  • macOS 14 ARM
  • macOS 14 x86_64
  • FIPS 140-2 compliant Red Hat Enterprise Linux (RHEL) 9 x86_64

Issues resolved in this release:

• Fixed an issue where promoting a replica using the disaster recovery workflow could lead to file sync corruption and code deployment failures.
• Fixed an issue where the recover_configuration cron job could sometimes cause a Puppet server restart.
• Included REXML Ruby gem, correcting issues for modules reliant on XML interactions with the REXML library.
• Fixed an issue where pinning a node resulted in the pinned node being incorrectly displayed in the main rules section when a node group was set to match any rule.
• Added use of the full Puppet binary path for backup and restore commands, eliminating certain failures during backup commands (e.g., running the backup command from a cron job).

Security fixes in this release:

• Addressed the following CVEs:
  • CVE-2024-22871
  • CVE-2024-1597
  • CVE-2024-25710
  • CVE-2024-26308
  • CVE-2023-42503
  • CVE-2024-46218

RELEASE NOTES   DEMO PUPPET ENTERPRISE

May 7, 2024

Starting with 3.0.0, Puppet Comply is now Security Compliance Management, and it’s included with Puppet Enterprise! Access it through the Security Compliance Management Console, exclusively in Puppet Enterprise to instantly gain valuable insight into the state of security of your Puppet estate.

Security Compliance Management retains all key features of Puppet Comply, including compliance assessment, monitoring, and reporting for configurations in your Puppet-managed infrastructure. Maintained and supported by Puppet, Security Compliance Management receives regular updates, just like Comply.

Automatic enforcement and remediation of hardened security baseline configurations is available in Security Compliance Enforcement (formerly Compliance Enforcement Modules), available as a premium feature for Open Source Puppet and Puppet Enterprise.

This release includes the latest CIS-CAT® Pro Assessor, support for the latest CIS Benchmarks for key operating systems, fixes for various issues, and resolutions for security vulnerabilities in third-party dependencies.

New in this release:  

• Puppet Comply is now Security Compliance Management
• Security Compliance Management is now included in the full Puppet Enterprise suite
• New installer wizard: The new Puppet Bolt-based installer for Security Compliance Management provides an easy wizard for installing, upgrading, and configuring Security Compliance Management in an agentless fashion via SSH.
• Inclusion of CIS-CAT® Pro Assessor v4.41.0 (released Apr. 25, 2024).
  • Security Compliance Management is regularly updated with the latest version of the CIS-CAT Pro Assessor, which assesses system compliance with CIS Benchmarks to generate actionable insights.
• Added support for the latest CIS Benchmarks for the following operating systems:
  • Debian Linux 11 Benchmark v2.0.0
  • Microsoft Windows 10 Stand-alone Benchmark v3.0.0
  • Microsoft Windows Server 2016 Benchmark v3.0.0
  • Microsoft Windows Server 2019 Benchmark v3.0.0
  • Microsoft Windows Server 2022 Benchmark v3.0.0
  • Ubuntu Linux 18.04 LTS Benchmark v2.2.0
  • Ubuntu Linux 22.04 LTS Benchmark v2.0.0

Issues resolved in this release:

• Fixed an issue where users could not change the desired compliance after changing the OS on a node.

Security fixes in this release:

• Resolved security vulnerabilities present in embedded, third-party dependencies of the CIS-CAT Pro Assessor v4.41.0:
  • PostgreSQL updated to v42.7.2.
  • xmlsec updated to v4.0.1.
  • cxf-core-updated to v3.5.8.
  • bouncycastle updated to v1.78.

WINDOWS RELEASE NOTES   LINUX RELEASE NOTES

May 7, 2024

New name, same great enforcement! Starting with 2.0.0, Compliance Enforcement Modules (CEM) is now Security Compliance Enforcement. It’s still a premium feature for Open Source Puppet and Puppet Enterprise that enforces secure configurations aligned to CIS Benchmarks and DISA STIGs — and it’s still created and supported by Puppet.

But the name’s not the only thing that’s changed. Security Compliance Enforcement 2.0.0 for Windows and Linux includes important updates to supported operating systems (including support for Ubuntu 20.04) and bug fixes to keep your infrastructure configurations aligned to security recommendations.

As part of the name change, the modules are now available on the Puppet Forge as sce_linux and sce_windows. If you have an active subscription to the Compliance Enforcement Modules (CEM), you are automatically granted access to the Security Compliance Enforcement modules.

New in these releases:

Security Compliance Enforcement for Linux 2.0.0

• Compliance Enforcement/Compliance Enforcement Modules/CEM for Linux is now Security Compliance Enforcement for Linux
• Added support for the latest CIS Benchmarks for the following operating systems:
  • Red Hat Enterprise Linux 8 (CIS Benchmark v3.0.0 Levels 1 and 2)
  • Oracle Enterprise Linux 8 (CIS Benchmark v3.0.0 Levels 1 and 2)
  • Alma Linux 8 (CIS Benchmark v3.0.0 Levels 1 and 2)
  • Rocky Linux 8 (CIS Benchmark v2.0.0 Levels 1 and 2)
  • Ubuntu 20.04 (CIS Benchmark v2.0.1 Level 1)

Security Compliance Enforcement for Windows 2.0.0

• Compliance Enforcement/Compliance Enforcement Modules/CEM for Windows is now Security Compliance Enforcement for Windows

Security fixes in these releases:

• Security Compliance Enforcement for Linux and Security Compliance Enforcement for Windows now support the latest versions of their respective Puppet module dependencies.
• Several bug fixes in both Security Compliance Enforcement for Linux and Security Compliance Enforcement for Windows.

DEMO COMPLY   RELEASE NOTES

March 14, 2024

Secure enterprise IT relies on simple, sensible access to valuable data on your security and compliance posture. In the previous release, we introduced a new REST API to help users retrieve and use data from Puppet Comply. With 2.19.0, we're making those powerful insights even more accessible and actionable with two new API endpoints for Export and Inventory functions.

This release also includes an update to the CIS-CAT Pro® Assessor embedded in Puppet Comply, updated benchmark support for enterprise Windows, and regular fixes for known security vulnerabilities.

New in this release:

• Additions to the Comply API. Improved accessibility and efficiency of Comply functions by adding two new endpoints to the Comply API.
  • Exports API: Create, retrieve, download, and delete exports of data from Puppet Comply.  
  • Inventory API: Initiate a Puppet Enterprise inventory sync.  
• Inclusion of CIS-CAT Pro Assessor v4.39.0 (released Feb. 28, 2024).
  • Comply is regularly updated with the latest version of the CIS-CAT Pro Assessor, which assesses system compliance with CIS Benchmarks to generate actionable insights.
• Updated support for CIS Benchmarks:
  • Microsoft Windows 10 Enterprise v3.0.0
  • Microsoft Windows 11 Enterprise v3.0.0  

Security fixes in this release:

• Resolved security vulnerabilities present in embedded, third-party dependencies of the CIS-CAT Pro Assessor v4.39.0.
  • commons-compress updated to v1.26.0
• Resolved CVE-2023-26159.
  • Upgraded follow-redirects-1.15.2 dependency to follow-redirects-1.15.4

DEMO PUPPET    RELEASE NOTES 5.3    RELEASE NOTES 4.29

Feb. 8, 2024 

We’re thrilled to share a new release for Continuous Delivery for Puppet Enterprise that will help you gain greater control of pipeline creation, as well as a new reporting function that will show the impact of Puppet across your organization. We’ve listened to your feedback to improve functionality and visibility in this latest release.

Watch: Introducing Activity Report in Continuous Delivery for Puppet Enterprise

New for this release:

• APIs for Automation: You wanted to automate end-to-end workflows, and now public APIs will allow you to automate connecting your Continuous Delivery for Puppet Enterprise installation to change management tools (e.g. Remedy). Create new pipelines and edit existing ones in your workspace — easily enabling you to add modules and repositories. 
• Activity Report: We’ve added a new activity report that shows the value Puppet Enterprise is providing to your organization across all instances. You can now specify the time saved per task and per plan, which will help visualize the value Puppet is providing for key workflows. 
• Personal access token management. You can now create authentication tokens to allow a user to enter their credentials once, then receive an alphanumeric token to access different services or parts of the system infrastructure. To manage personal access tokens, see Manage personal access tokens. 
• OpenAPI support. You can now fetch data and automate your workflows with the Continuous Delivery for Puppet Enterprise REST API. To get started using Continuous Delivery for Puppet Enterprise public APIs, see REST API. 
• Value reporting. You can now view activity values across all the Puppet Enterprise (PE) instances integrated within a workspace in the Activity report. To view your activity in Continuous Delivery for Puppet Enterprise, see Activity reporting. 
• Refreshed Continuous Delivery for Puppet Enterprise pipelines UI. The Continuous Delivery for Puppet Enterprise pipelines pages have a refreshed appearance.
• Generate new SSL certificates. Added a cd4peadm::regen_certificates plan to generate new SSL certificates for the app, using the current configuration. After running this plan, usecd4peadm::apply_configuration to upload the new certificates to Continuous Delivery for Puppet Enterprise. 

Security fixes in this release:

• CVE-2023-39325. Updated several direct and indirect dependencies to address this vulnerability.

STS RELEASE NOTES  LTS RELEASE NOTES  DEMO PUPPET

Feb. 6, 2024

You rely on your infrastructure to drive performance, security, and time to value. Puppet Enterprise 2023.6 (STS) and 2021.7.7 (LTS) focus on performance to deliver faster, more efficient automation workflows with a host of updates and enhancements.

Puppet users can expect enhanced increased responsiveness that enables them to meet the demands of modern IT operations faster than before. These releases also improve scalability to ensure that automation remains robust and reliable, even in large IT environments increasing the number of concurrent plans that can run.

Updates in these releases:

PE 2023.6 (STS)

• Identify operational issues affecting infrastructure nodes: The PE console now includes an Operational status page showing the result of the latest checks performed by the pe_status_check module. Issues requiring your attention are listed under the affected infrastructure nodes.
• Run 100+ plans concurrently: PE 2023.6 introduces the pe-plan-runner service, which runs on the primary server by default, allowing concurrent execution of up to 100 plans. pe-plan-runner also has the potential for further scaling based on available memory on the primary server.
• Include or exclude catalog resource edges in catalogs sent to PuppetDB.
• A new guided workflow for configuring and running task jobs.
• Specify ciphers to use when establishing connections to configured LDAP servers.
• Added agent support for AIX 7.3.

PE 2021.7.7 (LTS)

• Added agent support for AIX 7.3.

Issues resolved in these releases:

PE 2023.6 (STS)

• Fixed issues where restoring PE from a backup could fail when puppet agent was running, if lockless code deployments were enabled, or when setting the classifier_host parameter.
• Fixed an issue where upgrading the agent to Puppet 8 on FIPS-compliant RHEL 7 or 8 could cause the puppet service to stop unexpectedly.

PE 2021.7.7 (LTS)

• Fixed issues where restoring PE from a backup could fail when puppet agent was running, if lockless code deployments were enabled, or when setting the classifier_host parameter.

Security fixes in these releases:

PE 2023.6 (STS) & PE 2021.7.7 (LTS)

• Critical updates to Java, Postgres, and logback.
  • Addressing CVE-2023-6378, CVE-2023-6378, CVE-2023-40167, CVE-2023-36479, CVE-2023-41900, CVE-2023-5869, CVE-2024-20952, CVE-2024-20918, CVE-2023-44487, CVE-2023-5072, CVE-2024-20932

RELEASE NOTES   DEMO COMPLY + CEM

Puppet is excited to announce the immediate availability of Puppet CEM for Linux v1.9.0, featuring valuable added capabilities for enterprise customers.

Configuration drift is often cited by experts as a leading cause of security incidents and failed audits. Puppet’s Compliance Enforcement Modules (CEM) identify and quickly resolve configuration drift within infrastructure using policy-as-code (PaC) and are available for numerous editions of Windows and Linux.

CEM for Linux v1.9.0 incorporates support for the Center for Internet Security (CIS) benchmarks for two additional operating systems: Red Hat Enterprise Linux (RHEL) 9 and Oracle Linux 9, to ensure that these popular operating systems remain configured according to security policy. Both Level 1 and Level 2 benchmarks are supported.

CIS Level 1 benchmark profiles cover base-level configurations that are easier to implement and have minimal impact on business functionality. Level 2 benchmark profiles are intended for high-security environments and require more coordination and planning to implement with minimal business disruption.

Organizational efficiency gets a boost thanks to an improved auditing process which permits running a single Puppet Bolt® plan that includes up to 40 audit tasks to verify the configuration on one or more specified nodes.

Added

• Introduced support for the RHEL 9 operating system. You can now enforce the Center for Internet Security (CIS) RHEL 9 Benchmarks, Levels 1 and 2.
• Introduced support for the Oracle Linux 9 operating system. You can now enforce the Center for Internet Security (CIS) Oracle Linux 9 Benchmarks, Levels 1 and 2.
• The Bolt plan, run_audit, can be run with up to 40 audit tasks on one or more specified nodes to verify their configuration. The Bolt log file provides a list of audited controls and detailed results.

Changed

To help ensure compatibility between CEM for Linux and Puppet 8, the range of supported versions for the Puppet Labs® firewall module was changed. The firewall module must be at version 5.0 or later, but earlier than 6.0. 

RELEASE NOTES   DEMO COMPLY + CEM

Dec. 13, 2023

With the debut of Puppet Comply 2.18.0, Puppet is thrilled to announce the immediate availability of a powerful REST API for Puppet Comply. This valuable new interface allows users to quickly retrieve data at scale from Comply to share among groups and enrich other tools in the stack.

The new API leverages Comply’s native scalability to support data extraction for up to 100,000 nodes, enabling simpler enterprise compliance reporting at the summary and detail levels. Puppet’s open, integrated approach ensures data consistency across teams and tech to unlock productivity through smoother collaboration. No matter how you manage compliance, Comply’s new API enables the transparency, accountability, and responsiveness auditors require – and creates a single window of deep compliance visibility.

Additionally, an updated CIS-CAT Pro Assessor and no fewer than 10 updated Center for Internet Security (CIS) Benchmarks help Comply users stay abreast of the latest security standards across operating systems. Updates for AlmaLinux, macOS 11 and 12, Oracle Linux, and RHEL 8, along with a brand-new benchmark for macOS 13, round out the growing list of supported CIS Benchmarks in Comply.

New in this release:

• Added a RESTful API for Puppet Comply.
• Included the CIS-CAT Pro Assessor v4.36.0 (released Nov. 2023).

Benchmarks updated in this release:

• CIS AlmaLinux OS 8 Benchmark v3.0.0
• CIS Apple macOS 11.0 Big Sur Benchmark v4.0.0
• CIS Apple macOS 11.0 Big Sur Benchmark v4.0.0
• CIS Apple macOS 12.0 Monterey Benchmark v3.0.0
• CIS Microsoft Windows Server 2012 (non-R2) Benchmark v3.0.0
• CIS Microsoft Windows Server 2012 R2 Benchmark v3.0.0
• CIS Microsoft Windows Server 2016 STIG Benchmark v2.0.
• CIS Oracle Linux 8 Benchmark v3.0.0
• CIS Red Hat Enterprise Linux 8 Benchmark v3.0.0
• CIS Rocky Linux 8 Benchmark v2.0.0

Benchmarks added in this release:

• CIS Apple macOS 13.0 Ventura Benchmark v2.0.0

Benchmarks removed in this release:

• CIS Apple macOS 10.15 Catalina Benchmark v3.0.0

Issues resolved in this release:

• Node results page shows compliance score without exceptions.
• Security fixes.

RELEASE NOTES   DEMO PUPPET

Nov. 30, 2023

This release of Continuous Delivery for Puppet Enterprise (CD4PE) touts performance improvements and enhancements to Impact Analysis, a key feature that enables a powerful added layer of visibility to help you preview the potential impact of changes to your code before deploying.

New in this release:

• Impact Analysis enhancements: It is now possible to filter the number of nodes running impact analysis by a percentage of the total nodes affected to reduce bottlenecks for customers with large installs.  

Issues resolved in this release:

• Fixed an issue in the node table so that fact charts show the correct number of nodes with filters applied.

Security fixes in this release:

• CVE-2023-36478: CD4PE is not vulnerable to this CVE, but it now runs the updated version of Jetty that addresses this vulnerability.
   

RELEASE NOTES   DEMO COMPLY + CEM

Nov. 2, 2023

Comply receives another boost in supported node count with support for a maximum of 100,000 nodes. The latest CIS-CAT Pro® Assessor from The Center for Internet Security (CIS) has been integrated, with updates to Ubuntu Linux benchmarks and removal of several older benchmarks. The CIS-CAT Pro Assessor for MacOS now contains embedded Java.

New in this release:

• Scalability improvements for enterprise-grade compliance management.
  • Node count increased to 100,000.
• Embedded JRE for MacOS eliminates the need for a separate Java install.
• Included the CIS-CAT Pro Assessor v4.34.0.
  • Updated support for CIS Benchmarks for Ubuntu Linux 20.04 LTS Benchmark v2.0.1.
  • Removed support for older CIS Benchmarks.

Issues resolved in this release:

• Resolved several reported issues.

RELEASE NOTES   DEMO COMPLY + CEM

Oct. 24, 2023

The latest release of CEM for Linux features brand-new support for enforcing Level 1 and Level 2 CIS Benchmarks for Rocky Linux 8.

Additionally, support for RHEL 8, AlmaLinux 8, and Oracle Linux 8 systems is now enhanced with the addition of several additional important security controls, including ensuring that the Linux talk and remote shell (rsh) clients are not installed, and automatically locking inactive user accounts within 30 days of password expiration. Not to be left out, Oracle Linux 7 now benefits from the added security of no fewer than 5 additional controls!

New in this release:

• CIS Benchmarks (L1 & L2) are now enforceable on Rocky Linux 8. 
• The following Red Hat Enterprise Linux (RHEL) 8, AlmaLinux 8, and Oracle Linux 8 systems controls can now be enforced(see release notes for additional control details):
  • Control 2.3.2
  • Control 2.3.3
  • Control 5.6.1.4  
• The following Oracle Linux 7 systems controls can now be enforced (see release notes for additional control details):
  • Control 1.4.1  
  • Control 1.4.2  
  • Control 1.6.1.2  
  • Control 4.1.1.3
  • Control 4.1.2.4

Issues resolved in this release:

• Fixed an issue related to data protection in log files. The CIS Oracle Linux 8 Benchmark v2.0.0 now ensures access permissions are also enforced for log files that are hidden. 

4.27.1 RELEASE NOTES   5.1.2 RELEASE NOTES    DEMO CD4PE

Oct. 11, 2023

This dual release of CD4PE removes barriers to efficiency by correcting an issue that could cause jobs to fail in the first stage of the pipeline.

Issues resolved in these releases:

• Corrected an issue in which CD4PE jobs had a chance of failing if run in the first stage of the pipeline (following a series of changes in a previous version that added additional context to the job environment). 

RELEASE NOTES    DEMO CD4PE

Oct. 4, 2023

This release corrects an issue that could cause login errors, improving the user experience for CD4PE users.

Issues resolved in this release:

• Fixed an issue that could create login errors for LDAP users when deleting a workspace.

STS RELEASE NOTES  LTS RELEASE NOTES  DEMO PE 2023.4

STS: Oct. 3, 2023 
LTS: Sept. 2023

Your increasingly complex IT environment needs to move faster than ever, so we’ve updated Puppet to ensure your IT operations teams can keep pace to drive better performance and scale your enterprise infrastructure. The 2023.4 release of our leading-edge PE release stream (also referred to as STS) includes powerful new improvements that will help you increase operational efficiency by maximizing resources and streamlining processes.

New in these releases:

PE 2023.4 (STS)

• Puppet 8: PE 2023.4 includes Puppet 8, the eighth full release of Puppet’s open source code. Puppet 8 includes updates to configuration reporting, protections for user inputs, and more. Additionally, access to the latest OS versions like OpenSSL 3 and Ruby 3.2 will improve performance and add additional security.
• Effortless certificates management: Auto-renewal alleviates the challenge of manually reinstating expired certificates across your IT.  

Watch Certificate Management in Action in PE 2023.4

• Orchestrator enhancements: Improvements to the Orchestrator constrain task concurrency to individual jobs rather than sharing across jobs, allowing independent jobs to start execution without latency.
• PuppetDB efficiency improvements: PuppetDB will make sure reports run smarter with optimized indexes, increasing speed and efficiency.  
• New OS support for primary and secondary: MacOS 13 (ARM and x86_64) Agents, Ubuntu 22.04 & RHEL 9 Primary
• Enhanced UI: Edit scheduled plans effortlessly with a simplified interface.
• More enhancements: This release includes several changes designed to increase efficiency and usability.

PE 2021.7.5 (LTS)

• Classifier service flags unmappable legacy facts in node group rules: PE 2021.7.5 generates warning messages to flag uses of certain legacy facts that don’t map to equivalent structured facts in Puppet 8.
• New OS support for primary and secondary: MacOS 13 (ARM and x86_64) Agents, Ubuntu 22.04 and RHEL 9 Primary
• Customizable HTTP-client limits in Orchestrator: Specify connection limit parameters to match infrastructure requirements.
• Configurable socket timeout in Orchestrator: Specify the maximum time before socket timeout by changing the default value.
• Improved error logging for the puppet backup command: In PE 2021.7.5, descriptive error messages will display in the terminal and log file, instead of generic messages displayed in previous releases.
• Added primary server platforms: RHEL 9 x86_64, Ubuntu 22.04 amd64
• Added agent platforms: macOS 13 ARM and x86_64
• Added client tools platforms: macOS 13 ARM and x86_64
• Added patch management platforms: RHEL 9 x86_64
• Removed agent platforms: CentOS 7 aarch64, macOS 10.15, Oracle Linux 7 aarch64, Red Hat 7 aarch64, Scientific Linux 7 aarch64
• Removed client tool platform: macOS 10.15

Issues resolved in these releases:

PE 2023.4 (STS)

• Fixed an issue in which installing a Windows agent through the console could fail when the Test Connections checkbox was selected.

PE 2021.7.5 (LTS)

• Fixed an issue in which installing a Windows agent through the console could fail when the Test Connections checkbox was selected.

Security fixes in these releases:

PE 2023.4

• Addressed CVE-2023-5255.

RELEASE NOTES  DEMO COMPLY + CEM

Sept. 28, 2023

Keep your configurations consistent and compliant at scale with regular updates to Compliance Enforcement Modules (CEM), available in Puppet Comply. This release features updated support for STIG benchmarks for Red Hat Enterprise Linux (RHEL) 7 and 8 along with a slew of updates to improve the user experience.

New in this release:

• Updated support for STIG benchmark to Version 3 Release 12 (V3R12) for RHEL 7.
• Updated support for STIG benchmark to Version 1 Release 11 (V1R11) for RHEL 8.

Issues resolved in this release:

• Regular bug fixes (see full release notes above).

RELEASE NOTES    DEMO COMPLY + CEM

Sept. 21, 2023

Large enterprises continue to receive attention from the Comply engineering team. To give IT teams an even broader degree of decision-making power over their infrastructure compliance, Comply 2.16.0 features dramatic increases to supported node count, continuing a trend from recent Comply releases.

Comply 2.16.0 also integrates the latest CIS-CAT Pro® Assessor from The Center for Internet Security (CIS), with updates to Ubuntu Linux and Debian Linux benchmarks.

New in this release:

• Scalability improvements for enterprise-grade compliance management.
  • Node count increased to 75,000.
• Updated support for CIS Benchmarks.
• Included the CIS-CAT Pro Assessor v4.33.0.
• Resolved several reported issues.

RELEASE NOTES  DEMO CD4PE

Sept. 8, 2023

Streamline Puppet code testing even further with a new installation method based on Bolt, fully supported by Puppet. New to CD4PE 5.0.0, the lightweight installer helps users reduce TTV with a familiar workflow, improved supportability and a seamless install process that doesn’t involve Kubernetes administration. With the new CD4PE installer, your team can start using CD4PE faster than ever, keep driving value with a streamlined upgrade path, and save time with easier license management and troubleshooting.

CD4PE 5.x series replaces Puppet Application Manager with Puppet Bolt for installation and management. Users must migrate 4.x series data (including the database, object store, and configuration settings) to the new installation. For migration instructions, visit Docs.

New in this release:

• New Bolt-based installer and administration platform. In the CD4PE 5.x platform, Puppet Bolt, an open-source agentless automation tool fully supported by Puppet, is now used to manage an automated plan for installing CD4PE. The replacement enables a significantly streamlined experience for installation, upgrades, license management, troubleshooting, and more.

Removed in this release:

• Deprecated support for Puppet Application Manager. In CD4PE 5.0.0, Puppet Application Manager has been replaced by Puppet Bolt for installation and management. 

RELEASE NOTES  DEMO COMPLY + CEM

Aug. 22, 2023

Staying aligned with the most up-to-date benchmarks from the Center for Internet Security (CIS) is the best way to ensure that you’re benefitting from the latest security recommendations.

Puppet’s Compliance Enforcement Modules (CEM) simplify the task of keeping your Puppet Enterprise-managed nodes in continuous compliance with recent benchmark releases for popular versions of Microsoft Windows and Linux.

New in this release:

• Added enforcement for the Center for Internet Security (CIS) Benchmark v2.0.0 for the following Windows operating systems:
  • Microsoft Windows 10 Enterprise
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2016
• Enhanced upgrade documentation to ensure a smooth transition to version 1.5.0. 

RELEASE NOTES    DEMO CD4PE

Aug. 2023

A series of UI updates in Continuous Delivery for Puppet Enterprise 4.26.0 make it easier to find what you need to test and deliver your Puppet code faster and with greater accuracy. In addition, a security fix addresses a CVE related to the Okio client when handling a GZIP archive to improve the usability and reliability of CD4PE.

New in this release:

• Refreshed the “Control Repos” and “Modules” pages.
• Modernized the UI for easier, more intuitive navigation.
• Large object data store is now using PostgreSQL.

Security fixes:

• Upgraded okio-jvn to version 3.4.0 to address CVE-2023-3635.

RELEASE NOTES   DEMO COMPLY

Aug. 10, 2023

Compliance scalability continues to be a challenge for enterprise organizations, which means it's a major focus for the Comply engineering team. Following the notable increases to supported node count in 2.14.0, Comply 2.15.0 has also now dramatically improved export functionality to allow users to export raw data results for up to 50,000 nodes.

Leaning into our valued partnership with the Center for Internet Security (CIS), Comply 2.15.0 also integrates the CIS-CAT Pro® Assessor v4.32.0 with updates to MacOS benchmarks.

New in this release:

• Scalability improvements for enterprise-grade compliance management.
  • Raw data export support increased to 50,000 nodes.
• Updated support for CIS Benchmarks.
  • Included the CIS-CAT Pro Assessor v4.32.0 (July 2023) with benchmark coverage for Apple macOS 11 v3.1.0 and 12 v2.1.0.
  • Resolved several reported issues.

Issues resolved in this release:

• Fixed an issue where inventory sync made paging requests without ordering, leading to ingest retrieving fewer hosts than expected. Also improved database efficiency and accuracy.
• Fixed an issue where filters in the 'Compliance over time' chart could display missing days.
• Fixed an issue where discrepancies appeared between active exceptions counts on the Comply dashboard and the exceptions page.

RELEASE NOTES  DEMO CD4PE

When it comes to code delivery, usability is key to saving time and reducing headaches. A new series of UX updates – including message updates and a refresh of some of the most user-facing pages in CD4PE – make it easier than ever for teams to work together to integrate and deliver great Puppet code. Additionally, a slew of issue fixes and security updates make sure you can keep working in CD4PE with confidence.

New in this release:

• Refreshed the “Create Account” and “Forgot Password” pages in CD4PE.
• Modernized the UI for easier, more intuitive navigation.

Issues resolved in this release:

• CD4PE default pipeline impact analysis fails with a non-actionable error message: Updated the error message to make it more descriptive and useful when a pipeline with no deployment stage fails the impact analysis stage.  
• GetJobInstanceV1 returns control repo display name for GitLab: Fixed an issue where links to a GitLab source control repository from the Job details screen wouldn't work if the control repo/module name did not match the GitLab repo name.  

Security fixes:

• Upgraded gin-gonic to version 1.9.1 to address CVE-2023-29401.
• Upgraded guava to version 32.0.0-android to address CVE-2023-2976.

The refreshed "Create user account" page in CD4PE 4.25.0.

RELEASE NOTES  DEMO PUPPET COMPLY

One of the most frequently requested features for Puppet Comply has been to support different user roles. Comply 2.14.0 adds role-based access control, enabling you to designate three roles based on access need. We also increased node support in this release so you can confidently stretch your compliant infrastructure even further.

We also updated integration with the latest CIS-CAT Pro Assessor and numerous benchmarks, and resolved a few vulnerabilities in this release.

• Identity and access management
  • RBAC integration with three default roles: Admin, operator, and viewer
  • Support for importing from LDAP
• Scalability improvements for enterprise-grade compliance management
  • Node count increased to 50,000
• Updated support for numerous CIS Benchmarks
• Included the CIS-CAT Pro Assessor v4.30.0
• Addressed multiple CVEs
• Resolved an issue when scanning a node in the Darwin family (Mac OS X/macOS)

RELEASE NOTES   DEMO COMPLY + CEM

With CEM for Windows, you can bring your Puppet Enterprise-managed nodes into compliance with the CIS Benchmark for Windows Server 2022, Windows Server 2019, Windows Server 2016 and Windows 10. The expanded support in CEM for Windows 1.4, coupled with the existing broad coverage in CEM for Linux, allows you to enforce CIS Benchmark compliance across your Windows and Linux infrastructure.  

• Added enforcement for the Center for Internet Security (CIS) Microsoft Windows Server 2022 Benchmark v2.0.0
• cem_windows no longer supports the use of legacy configuration as of this update. cem_windows is no longer compatible with configurations that were used before v1.1.0. Please update any legacy configuration to the current standard of configuring cem_windows 

PE 2023.1 RELEASE NOTES

PE 2021.7.3 RELEASE NOTES

These patch releases include fixes and performance upgrades for existing features.

These releases represent the latest updates in the Puppet Enterprise (PE) 2023 and 2021 streams, following the releases of PE 2023.0 and PE 2021.7.2 LTS in January 2023. These new, backward-compatible releases contain fixes and performance upgrades for existing features and functionality.

For a detailed list of enhancements and fixes in PE 2023.1, see the PE 2023.1 release notes.
For a detailed list of enhancements and fixes in PE 2021.7.3, see the PE 2021.7.3 release notes.

For security and vulnerability announcements, see CVE Content.

Performance enhancements in these releases: 

• Improved performance when querying PuppetDB
• Improved performance for several functions in the Puppet language
• More reliable warnings when updating Puppet Server

Deprecation of Pure JavaScript Open Notation (PSON) for serializing data in Puppet 7

Resolved issues in these releases: 

• Tasks page is available following a software update
• Enabling the lockless code deploy feature no longer causes performance issues in PuppetDB catalog compilation
• Performance issue with Puppet agent runtimes is resolved
• Certificates and keys can be backed up and restored by specifying the certs scope
• Updates implemented to help users enter valid URLs
• Timeouts can be specified for SAML authentication
• User-defined temporary directory is honored during PE restore operations
• Issue that caused an unexpected increase in CPU usage is resolved

Additional issues resolved in PE 2023.1, related to new features in 2023.0:

• Scheduled task jobs run successfully without a defined timeout
• Timeout and concurrency values for scheduled tasks can be viewed and edited in the console
• When tasks are rerun in the console, timeout and concurrency attributes are preserved
• Access rights for remote users can be revoked and reinstated from the console

Security fixes in both releases:

• CVE-2023-1894
• CVE-2023-26048

RELEASE NOTES

Effective compliance requires good visibility. Comply’s dashboard has received significant enhancements in 2.13.0, bringing new clarity to your compliance standing. Compliance statistics are reported on servers that live on-prem or in the cloud. Search and subset node views based on server attributes, such as name or operating system, and drill down to key focus areas to quickly identify areas where action is needed.

As always, we called upon our unique partnership with the Center for Internet Security (CIS) to power Comply with the latest CIS-CAT Pro Assessor (v4.28.0), and we’ve incorporated the latest benchmarks and standards so your compliance has the most up-to-date expert standards built in.

We even had time to fix a couple of nagging little bugs from prior releases, address a few CVEs, and boost performance.

• Redesigned dashboard with new graphs, node count and exceptions, and accessible action steps  
• Improved performance and scalability
• Included the CIS-CAT Pro Assessor v4.28.0
• Updated benchmark support
• Resolved multiple vulnerabilities

RELEASE NOTES   UPGRADE   START PE TRIAL

April 2023

Puppet powers better infrastructure in thousands of organizations worldwide – and changes to Puppet source code always target better efficiency, scalability, and usability. Puppet 8 is the biggest update to Puppet since Puppet 7’s first release in November 2020. Along with a host of behind-the-scenes updates, Puppet 8 adds brand-new features that ensure better security, reliability, and performance, like automatic certificate renewal and an error-proof Strict Mode.

Puppet 8 is included in all Puppet Enterprise releases since PE 2023.4 (STS) and PE 2021.7.5 (LTS).

New in this release:

• Updates to certificate management: Automatic certificate renewal addresses a huge IT ops pain point. With customizable automatic certificate management, Puppet 8 reduces the toil of managing certificates across large fleets, enabling faster security fixes and continuous compliance across your infrastructure.
• Ruby 3.2 and OpenSSL 3: With Puppet 8, Puppet is now on the latest branch of Ruby 3.2 and OpenSSL 3, reducing vulnerability scanning concerns.
• Strict Mode: Puppet 8 introduces Strict Mode, which throws an error rather than allowing incorrectly passed changes (like typos). Strict Mode helps avoid both costly mistakes and unauthorized attempts to reassign variables.
• Default exclusion of unchanged resources from reporting: Unchanged resources will no longer appear in reporting by default, reducing the amount of digging needed to get to actionable insights from each Puppet run.
• Dropping Hiera 3: Removing Hiera 3 trims down the Puppet 8 install for better efficiency and performance.
  • If you rely on a Hiera 3 backend, you must convert your backend to Hiera 5.
• Default lazy evaluation of deferred functions: Operate with greater mobility and security when accessing something you don’t want passed through the Puppet infrastructure nodes (e.g., vault secrets).

Watch Certificate Management in Action

RELEASE NOTES

Puppet 2023.0 is the latest release following 2021.7, now using updated versioning. It’s a backward-compatible release that contains enhancements and resolved issues from our previous major release.

Here are the highlights of Puppet Enterprise 2023.0:

• NIST compliance: Puppet 2023.0 ensures that sensitive information is cleared when a session times out. You can customize the timeout to specify a default value and issue a confirmation message. In this way, you reduce compliance risk for InfoSecOps and administrators. This feature is designed for compliance with National Institute of Standards and Technology (NIST) guidelines. 
• Authenticate users in multiple Lightweight Directory Access Protocol (LDAP) domains: Use a prioritized list of LDAP servers to get credentials. In this way, you reduce compliance risk and increase operational efficiency for administrators. 
• Streamlined user interface for tasks and plans: Increase observability, throughput, fault tolerance, and operational efficiency with new job and task queue status, task concurrency fine-tuning, default job timeouts, and the capability to stop stalled jobs. View and edit task parameters, targets, and other details. The new functionality is designed to benefit users, operators, and managers. 
• Scalability performance improvements to deploy and manage more nodes: Increase operational efficiency and accelerate time to value with new orchestrator task concurrency defaults and improvements. Reporting, database performance, and agent certificate regeneration improvements are provided as well to benefit all users. 

Component Updates 

• Java 17

Deprecations

Removed primary server platforms:

• CentOS 8

Removed agent platforms:

• CentOS 8 
• Debian 9 
• Fedora 32 
• Fedora 34 
• Ubuntu 16.04

Removed patch management platforms:

• Debian 9 
• Fedora 34

READ RELEASE NOTES

• Multiple resolved issues
• Security fixes:
  • CVE-2022-41946 
  • CVE-2022-41404 

READ RELEASE NOTES

• Inclusion of Facter 4
• Inclusion of Ruby 2.7
• Definition of locations for storing sensitive data
• Removal of harmful terminology from the Puppet platform 
• Removal of several Win32 gems to consolidate Windows functionalities
• Environment and Fact caching
• Iterable data type supplants Enumerable data type
• Removal of legacy code
• Added Postgres 11+ requirement
• PuppetDB migration to new HTTP client

READ RELEASE NOTES

• New and revamped filters support more advanced queries
• Target specific sets of infrastructure data with compound filters

READ ANNOUNCEMENT

• New tracked metrics for Puppet Server, PuppetDB, and Orchestrator
  • Performance and workload metrics allow for better troubleshooting of performance issues
• Replaced default dashboards to visualize new metrics

• Lockless code deploy, stable since version 2021.2, is now no longer an experimental feature, preventing code deploys from blocking catalog compilation
• PE orchestrator plans and code deployments can now be run concurrently without interruption
• Primary server support: FIPS-compliant RHEL 8, SLES 15, Ubuntu 20.04; Client support: macOS 12 (x86); TLS 1.3 support added

• Optimized disk utilization for HA deployments 
• Amazon Linux 2 support for primary server deployment
• Patch management available for Amazon Linux 2 managed nodes 

• Modify Role-Based Access Control (RBAC) parameters via API 
• Sequential patching option allows for systems in a patch group to reboot one at a time rather than simultaneously 
• PuppetDB best-practices-based maintenance tasks are enabled by default 

• Code manager now supports authentication to custom servers 
• Puppet metrics collector module is now included in PE, which collects Puppet metrics by default and gives insight into infrastructure performance 
• PE_databases module is now included in PE and provides tuning, maintenance, and backups for PE PostgresSQL 

• Export data in shareable format from task runs to CSV 
• Platform support for Puppet agent additions: macOS, Red Hat Enterprise Linux 8 ppc64le, Ubuntu 20.04. aarch64, Fedora 34 
• Resolved critical CVE-2021-27021 

• Setup single sign-on (SSO) and multi-factor authentication (MFA) with SAML 2.0 support 
• Added password complexity requirements for additional application security 
• Orchestrate pre and post patching steps including: health checks, pre and post command hooks and server reboots, all with a patching Plan, 
• Save custom defaults for the Value Report to tailor reporting needs 
• Query performance updates to PuppetDB 
• Puppet 2021.1 ships with Puppet 7 

• Lockless code deploy, stable since version 2019.8.6, is now no longer an experimental feature, preventing code deploys from blocking catalog compilation 
• PE orchestrator plans and code deployments can now be run concurrently without interruption 
• Primary server support: FIPS-compliant RHEL 8, SLES 15, Ubuntu 20.04; Client support: macOS 12 (x86); TLS 1.3 support added 

• Patch management available for Amazon Linux 2 managed nodes 
• Optimized disk utilization for HA deployments 

• Sequential patching option allows for systems in a patch group to reboot one at a time rather than simultaneously 
• PE support script enhancements 

• PuppetDB maintenance module installed by default 
• Code Manager deployment performance improvements 

• Update Certificate Revocation List (CRL) via API 
• Export results of task jobs to CSV 

• Customize values used to derive value report results 
• Configurable Certificate Revocation List (CRL) auto-refresh interval 

• New patching plan that includes pre- and post-patching health checks to reduce manual steps during the patching process. 
• Performance improvements to PuppetDB. 

• Updates the PostgreSQL version to address security vulnerabilities 

• Harmful terminology deprecations and removals 
• Plans in PE improvements including scheduling plans and sensitive parameter support 
• Patching improvements including the ability to re-run tasks or jobs on failed nodes and know the patch status per node after patching task 
• Activity Service improvements that report on all activities done in the console 
• Installer upgrade improvements 
• Notification of CA certificates when they are close to expiring from the PE Console 
• PE Value Report builds on the value API in PE 2019.8.1 and gathers real-time data and calculates time reclaimed per automation type. 

• This version was never released. 

• Value reporting API reports details about automated changes that PE makes to nodes, and provides an estimate of time freed by each type of change based on intelligent defaults or values you provide. 
• Console navigation and workflow improvements including new sections and renamed pages 
• Select plan parameters that are boolean or enum types from a drop down menu in the Value field. 
• Updates to metrics endpoints are now controlled by trapperkeeper-authorization and configured in the Puppet Serverauth.conf file. 

• Integrate existing Puppet code into plans 
• Patch systems with Puppet, allowing organizations to consolidate tooling 
• Use less hardware with PE performance improvements 
• Seamlessly scale up and bring more nodes under management 
• Onboard new team members to a streamlined, modern product UI 

• Improvements to plan functionality in Puppet Enterprise (parameters exposed in PE console) 
• Improved PE architecture with horizontally scaled PuppetDB on compilers 
• Improved speed and reliability for provisioning a PE replica 
• Upgrade all compilers with a single command 

• This version was never released 

• Resolved a high-severity vulnerability CVE-2020-7943 

• Puppet Enterprise console enhancements 
• Inventory page revamp (each installation type has a button that links to its own page, more help icons and definitions) 
• Plans event view in the Job details page now displays an output message for each plan run 
• Two new API endpoints for Code Manager provide greater flexibility in deploying modules 

• Custom PQL queries in the console for running Puppet and tasks 
• New Run drop down menu so you can run Puppet or a task for the nodes listed on the current page 
• Ability to select code environment for tasks and plans (other than “production”) 

• Support for managing network devices with Puppet Enterprise 
• Support for running plans from console and CLI 
• Agent installation from the console (via Inventory option) 

• Schedule recurring tasks via Puppet Enterprise console 
• Add nodes without agents to Puppet Enterprise (new Inventory option on the console) 

• Agentless tasks via SSH (Linux) (2019.0.0) 
• Agentless tasks via WinRM (Windows) (2019.0.1) 
• Express installation (2019.0.2) 

• Continuous Delivery for Puppet Enterprise console installation (module via console) 

• Schedule tasks in Puppet Enterprise console 

• Role-based access to tasks 
• Puppet Discovery (retired) 

• Hiera overrides in the console (set parameters on node groups without declaring the class) 
• Ad-hoc tasks (run tasks from the console, on the command line, or by the orchestrator API) 
• AWS OpsWorks for Puppet Enterprise (offers cloud-focused workflows and managed service capabilities for running Puppet Enterprise on AWS) 

• Orchestrator in the console (create node lists, either static or using Puppet Query Language, on which to run Puppet) 
• Packages inventory in the console 

• Hiera 5 
  • Improved performance 
  • True environment- and module-level data