Getting Started and Working with Puppet 4 On RHEL 7 and CentOS 7

(: August 12, 2017)

Puppet is a Systems Configuration Management/Systems Automation framework written in Ruby that allows system administrators to programmatically provision, configure, and manage servers, network devices, and storage, in a data center or in the cloud. Puppet 4 On RHEL 7 and CentOS 7 makes it easy to create customized system configurations and perform ongoing management of machines by using a set of modules.

Why Configuration Management?

  • Reproducable setups: Do once and repeat many times
  • Scaling: Easy to scale to many machines, done for one but use on many
  • Coherent and consistent server setups
  • Visibility : Visibility into the changes occurring in your infra over time and impact on service levels.
  • Environment aligned for devel,test,qa and prod nodes

General Hardware recommendations for Puppet 4 On RHEL 7 and CentOS 7- Puppet Master node

  • Have fast CPU processor
  • Have adequate RAM
  • Have a faster hard drive.

When selecting right hardware requirements for your deployment, put in mind that the demands on the Puppet master may vary widely between deployments, major variables being:{text-align:left} img{margin:0 auto 0 0}
  1. The number of agents being served
  2. How frequently those agents check in
  3. How many resources are being managed on each agent
  4. The complexity of the manifests and modules in use.

Have a look at the Minimum Requirements Page for more details; Both for Monolithic and Split installation setups before doing Puppet 4 On RHEL 7 and CentOS 7.

  1. Facter – Puppet’s cross-platform system profiling library. It discovers and reports per-node facts, which are available in your Puppet manifests as variables.
  2. PuppetDB – Fast, reliable and scalable data warehouse that caches data generated by Puppet.
  3. Foreman – Complete lifecycle management tool for physical and virtual servers.
  4. Puppet DashBoard – A Puppet Web frontend and External Node Classifier (ENC)
  5. MCollective – Marionette Collective;framework for building server orchestration or parallel job-execution systems.

Puppet building blocks


Any configuration part of the system, e.g packages, services, files, users and groups, SSH Key authentication, cron jobs, SELinux configuration and more. Resource declarations are formatted as below:

resource_type {'resource_name':
    attribute => value,
    attribute => value,

Files ending with .pp extension. A manifest defines each required resource using a set of key-valuepairs for their attributes.


These are collection of related resources that once defined, can be declared as a single unit. A class may describe everything needed to configure an entire application or service. For example, a class can contain all of the resources (such as files, settings, modules, and scripts) needed to configure the Apache webserver on a host.


A module is a collection of classes, resource types, files, functions and templates, organized around a particular purpose. For example, a module can configure an Apache webserver instance or Rails application.

More info can be obtained from the official Puppet Glossary Page

My Lab setup

For this Puppet 4 On RHEL 7 and CentOS 7 setup, my deployment type is Agent/Master puppet – This setup requires a central puppet master server/s to host and compile all configuration data. The other nodes run the puppet agent service which will periodically pull its configurations from the master. The puppet master service has to be kept available and responsive.

My Lab setup is a two node, master and client with below settings :

Puppet Master
IP Addess
Puppet Client
IP Addess

Installing Puppet server

The newest version of Puppet can be installed from the package repository. On your RHEL 7 or Centos 7, just execute commands below to add repo and do the installation.

[[email protected] ~]# yum -y install

By using this added repo, version 4.x of Puppet will be installed. In Puppet 4, a lot of important config files and directories were changed. Review table below for essential directories and files to take note of.

Directory Explanatiom
/opt/puppetlabs/bin Puppet server binaries reside here
/opt/puppetlabs/puppet/bin/ Directory for private binaries
/opt/puppetlabs/server Where the server-side apps live underneath
/etc/puppetlabs/ Puppet’s system confdir; used by root and the puppet user. Contains code, mcollective, puppet, puppetserver and pxp-agent directories.
/etc/puppetlabs/puppet/ssl/ SSL directory
/etc/puppetlabs/code/environments/production/manifests/ Contain manifest files
/opt/puppetlabs/server/apps/puppetserver/ This is puppetserver app directory
/var/log/puppetlabs/ Logs directory
/var/run/puppetlabs Runtime directory

To install puppet master server run:

[[email protected] ~]# yum -y install puppetserver

For the version of Puppet installed here version 4.x, the main executables moved to /opt/puppetlabs/bin. This means all the puppet and related tools aren’t included in your PATH by default. Therefore, we’ll have to create symbolic links to make them system-wide available:

ln -s /opt/puppetlabs/bin/facter /usr/local/bin/
ln -s /opt/puppetlabs/bin/puppet* /usr/local/bin/
ln -s /opt/puppetlabs/bin/mco /usr/local/bin/
ln -s /opt/puppetlabs/bin/hiera /usr/local/bin/

Confirm that all symbolic links were created using:

[[email protected] ~]# ls -l /usr/local/bin/

Puppet Master Initial configurations

After successfully installing Puppet on a node to act as a puppet master server, you’ll need to perform below tasks for Puppet 4 On RHEL 7 and CentOS 7 setup to work smoothly.

1. Open port 8140 on the firewall. The puppet master server must allow incoming connections on port 8140 for agents to connect.

Using Firewalld
[[email protected] ~]# firewall-cmd --add-port=8140/tcp --permanent
[[email protected] ~]# firewall-cmd --reload 
[[email protected] ~]# firewall-cmd --list-ports 
Using IPTables
[[email protected] ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[[email protected] ~]# iptables -A INPUT -m state --state NEW -p tcp --dport 8140 -j ACCEPT
[[email protected] ~]# iptables-save
[[email protected] ~]# iptables -L -v

2. Name resolution configuration:

Every node must have a unique hostname. Forward and reverse DNS must both be configured correctly. If you don’t have DNS server in your setup environment, consider adding hostname and IP values to /etc/hosts file on each node. On my setup, I’ll add as below

[[email protected] ~]# echo " client" >> /etc/hosts

Also set the dns_alt_names which are a comma-separated list of alternate DNS names for Puppet Server. These are extra hostnames the server is allowed to use when serving agents.They are added in the [master] section of the master’s puppet.conf file.

[[email protected] ~]# vim  /etc/puppetlabs/puppet/puppet.conf 

Then add below line under [master] section:

dns_alt_names =,master

3. Generate CA certificate and the puppet master certificate with the appropriate DNS names. Since this is the only puppet master in my deployment demo, this step can’t be skipped.

[[email protected] ~]# puppet master --no-daemonize --verbose

Press Ctrl + C to quit

4. Now start and enable puppetmaster service:

[[email protected] ~]# systemctl enable puppetserver
[[email protected] ~]# systemctl start puppetserver 

Configure Puppet client

To install puppet client package, use below commands:

[[email protected]~]# yum -y install
[[email protected] ~]# yum -y install puppet-agent
Confifure Certificates

Enable certificate from the Puppet Client on the puppet master. First specify puppet server hostname on /etc/puppetlabs/puppet/puppet.conf file:

[[email protected] ~]# echo "server =" >> /etc/puppetlabs/puppet/puppet.conf
[[email protected] ~]# echo " master" >> /etc/hosts

Create binaries symlinks:

ln -s /opt/puppetlabs/bin/facter /usr/local/bin/
ln -s /opt/puppetlabs/bin/puppet* /usr/local/bin/
ln -s /opt/puppetlabs/bin/mco /usr/local/bin/
ln -s /opt/puppetlabs/bin/hiera /usr/local/bin/

Test certificate service from client server

[[email protected] ~]# puppet agent --test

Info: Creating a new SSL key for
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for
Info: Certificate Request fingerprint (SHA256): 09:BC:B0:BE:0C:8D:89:26:3F:0D:FB:FE:78:F4:4F:DD:31:4E:64:BA:B0:09:0F:B0:53:01:D4:E3:F1:03:18:15
Info: Caching certificate for ca

Start and enable puppet service:

[[email protected] ~]# systemctl start puppet.service 
[[email protected] ~]# systemctl enable puppet.service 

On the puppet master server, sign certificate request by Puppet client:

[[email protected] ~]# puppet cert list 

  "" (SHA256) 09:BC:B0:BE:0C:8D:89:26:3F:0D:FB:FE:78:F4:4F:DD:31:4E:64:BA:B0:09:0F:B0:53:01:D4:E3:F1:03:18:15

[[email protected] ~]# puppet cert --allow-dns-alt-names sign

Signing Certificate Request for:
  "" (SHA256) 09:BC:B0:BE:0C:8D:89:26:3F:0D:FB:FE:78:F4:4F:DD:31:4E:64:BA:B0:09:0F:B0:53:01:D4:E3:F1:03:18:15
Notice: Signed certificate request for
Notice: Removing file Puppet::SSL::CertificateRequest at '/etc/puppetlabs/puppet/ssl/ca/requests/'


So far we’ve installed both puppet master and client nodes. Let’s do some testing on our Puppet 4 On RHEL 7 and CentOS 7 setup to confirm everything works as expected. We’ll create simple test manifest and apply it to the client node. The manifest is to create a user named bob, with uid of 1000 and is a member of wheel group:

Generate encrypted password for the user

python -c 'import crypt,getpass; print(crypt.crypt(getpass.getpass(), crypt.mksalt(crypt.METHOD_SHA512)))'
Create manifest file on the master node
cat >> /etc/puppetlabs/code/environments/production/manifests/site.pp <<END
group { 'bob':
    ensure => present,
    gid    => 1000,
user { 'bob':
    ensure     => present,
    home       => '/home/bob',
    managehome => true,
    uid        => 1000,
    gid        => 1000,
    groups     => ['bob', 'wheel'],
    password   => '$6$kJyIyD53PMVwAOgc$ou/nTbSJrK1WlmOzsopwqj1kQ3VCm9afUZDAsHPswvxfbag7rQrdc4QZb9FYa/Ag28m7Bi.fkzpaXBZ5z56BH.',
    comment    => 'Bob User',

Restart puppet service on the client for the changes to quickly get manifest applied:

[[email protected] ~]# systemctl restart puppet

Now check to confirm user bob was created successfully

[[email protected] ~]# echo ""; id bob; echo "" ; getent passwd bob; echo ""; ls /home

uid=1000(bob) gid=1000(bob) groups=1000(bob),10(wheel)




On this blog post- working with Puppet 4 On RHEL 7 and CentOS 7, we’ve been able to successfully install and configure both the puppet master and Puppet v4 client. To this end, you should be ready to start learning and practicing with puppet 4. On our next Puppet tutorial, we’ll explore Puppet Resources, Classes, Advanced Manifests and how to write custom Puppet modules. Till then, stay tuned by following me on Twitter.{text-align:left} img{margin:0 auto 0 0}