Puppet Cheat Sheet
Reference for Puppet manifest syntax, resource declarations, classes, modules, and common puppet CLI commands.
2 PagesAdvancedFeb 2, 2026
Basic Manifest
A manifest installing, configuring, and running nginx.
puppet
package { 'nginx': ensure => installed,}file { '/etc/nginx/nginx.conf': ensure => file, content => template('nginx/nginx.conf.erb'), owner => 'root', mode => '0644', require => Package['nginx'], notify => Service['nginx'],}service { 'nginx': ensure => running, enable => true,}
Class Definition
Defining a reusable class with parameters.
puppet
class nginx ( String $port = '80', Boolean $enable_ssl = false,) { package { 'nginx': ensure => installed, } service { 'nginx': ensure => running, enable => true, require => Package['nginx'], }}# Usage in site.ppnode 'web1.example.com' { class { 'nginx': port => '8080', }}
Core Resource Types
Common built-in Puppet resource types.
- package- Manages package installation state (installed, absent, latest)
- file- Manages file/directory content, ownership, and permissions
- service- Manages service running/enabled state
- user / group- Manages user accounts and group membership
- exec- Runs arbitrary commands, ideally guarded with onlyif/unless/creates
- cron- Manages cron job entries
Puppet CLI
Common commands for applying and managing Puppet.
bash
puppet apply site.pp # Apply manifest locallypuppet apply --noop site.pp # Dry run, show changes onlypuppet agent -t # Trigger a run against Puppet Serverpuppet module install puppetlabs-nginxpuppet parser validate site.pp # Syntax check
Defined Resource Type
Create a reusable, instantiable resource type with the `define` keyword.
puppet
define nginx::vhost ( String $server_name = $title, Integer $port = 80, Boolean $ssl = false,) { file { "/etc/nginx/sites-available/${title}": ensure => file, content => epp('nginx/vhost.epp', { 'server_name' => $server_name, 'port' => $port, 'ssl' => $ssl }), notify => Service['nginx'], } file { "/etc/nginx/sites-enabled/${title}": ensure => link, target => "/etc/nginx/sites-available/${title}", }}# Usage - can be declared multiple times with different titlesnginx::vhost { 'blog.example.com': port => 8080 }nginx::vhost { 'api.example.com': ssl => true }
Hiera Data Lookup
Separate data from code using Hiera's automatic parameter lookup and the lookup() function.
yaml
# hiera.yamlversion: 5defaults: datadir: data data_hash: yaml_datahierarchy: - name: 'Node specific' path: 'nodes/%{trusted.certname}.yaml' - name: 'Environment' path: 'env/%{server_facts.environment}.yaml' - name: 'Common' path: 'common.yaml'# data/common.yamlnginx::port: 80nginx::enable_ssl: false
Exported Resources
Publish resources from one node and collect them on another via PuppetDB (storeconfigs).
puppet
# On each web node: export a firewall rule tagged with this node's identity@@firewall { "100 allow http from ${facts['networking']['ip']}": proto => 'tcp', dport => 80, source => $facts['networking']['ip'], action => 'accept', tag => 'web_fw',}# On the load balancer: collect every exported rule tagged web_fwFirewall <<| tag == 'web_fw' |>>
Advanced Puppet Ecosystem
Concepts and tools used in production Puppet deployments beyond basic manifests.
- custom facts- Ruby or shell scripts under `facts.d/` or `lib/facter/` that add data points to Facter
- r10k- Tool that deploys Puppet environments/modules from a Git control repo (Puppetfile) to the master
- PuppetDB- Stores catalogs, facts, and exported resources; backs storeconfigs and puppetdb-query functions
- eyaml- Hiera backend that encrypts individual values in YAML data files at rest
- Bolt- Agentless task/plan runner for ad-hoc orchestration over SSH/WinRM without a Puppet run
- catalog compilation- Server-side process turning a node's manifests + facts into a JSON catalog of resources
- environments- Isolated sets of manifests/modules (e.g. production, staging) selected per agent run
Iteration & Data Functions
Use the Puppet language's built-in iterative functions to transform data structures.
puppet
$users = ['alice', 'bob', 'carol']$users.each |String $user| { user { $user: ensure => present, home => "/home/${user}", }}$ports = [80, 443, 8080]$open_ports = $ports.filter |$p| { $p != 8080 }$configs = { 'web1' => 8080, 'web2' => 8081 }$configs.map |$name, $port| { "${name}:${port}" }.each |$entry| { notify { $entry: }}
Pro Tip
Always run 'puppet apply --noop' (or agent -t --noop) before rolling out manifest changes fleet-wide — it reports exactly which resources would change without touching the system.
Was this cheat sheet helpful?
Explore Topics
#Puppet#PuppetCheatSheet#DevOps#Advanced#BasicManifest#ClassDefinition#CoreResourceTypes#PuppetCLI#OOP#CommandLine#CheatSheet#SkillVeris
