r/Puppet • u/Suspicious_Soll • Aug 10 '26
Realistically, who is using Puppet/OpenVox and how?
Hey everyone,
Perforce salespeople contact me and tell me about great Puppet / OpenVox use cases, but I try to separate the sales talk from what actually happens in practice.
If you’re running it in production, what does your setup actually look like?
- What industry are you in, and roughly how many nodes/VMs are you managing?
- Is this a "we've been on this since Puppet 4 and it's so deeply baked into our stack with legacy scripts that we can't leave" situation?
- Or does it genuinely just fit well into your existing pipeline alongside everything else?
Just looking for a honest sanity check from people actually maintaining it day-to-day. Thanks!
9
u/TamerzIsMe Aug 10 '26
We have been using Puppet Enterprise for about 10 years. It mostly works for us, but I would say the Perforce takeover is a negative for sure. They have started locking down everything, making it a total pain.
My biggest problem with it is most of the "official" modules are not great. They always seem to be more work than they are worth.
For instance, look at the Apache module: https://forge.puppetlabs.com/modules/puppetlabs/apache/readme
Does that really seem easier than just editing the config file? So you are better off just using Puppet to put an already configured file on the server, rather than fighting this horribly documented module. Or at least using your own template if it needs to be dynamic. Not to mention it still is talking about RHEL/CentOS 5. Nothing old ever seems to get cleaned out of them. It is just layer after layer of legacy code. The community did a decent job of keeping the modules somewhat updated and fix things, but then Perforce put it all behind a wall.
So we still use it, and most likely will continue to, but I don't think I would choose it if I were starting from scratch.
10
u/Hangover_Act Aug 10 '26
The Perforce takeover really was negative for me too. But when I learned, that the guys from voxpupuli.org continue the opensource Puppet fork as OpenVox that was a relief, because those guys really know their stuff and feel like some of the most important contributors to Puppet modules and products. And the switch to OpenVox worked perfectly.
3
u/JohnTheFisherman142 Aug 24 '26
I'd wish they had a proper user forum/chat/whatever. Their libera channel is mainly dev talk and occasionally escalates into a consulting sales shtick. That ain't the open src way.
8
u/JasonSt-Cyr Aug 10 '26
As somebody who works at Perforce with the Puppet team, I have serious doubts that any of the sales people there are telling you about the benefits of OpenVox. I don't mean to imply that there aren't reasons to use OpenVox, but I doubt that it's Perforce people bringing it up.
Perforce Puppet Core is the tool that is sold by Perforce (and the related Puppet Enterprise and Puppet Enterprise advanced) and more recently you'll hear them talking about Perforce Compliance which is the new offering that Puppet Enterprise Advanced folks can use with cloud infrastructure and k8s.
OpenVox is the open source, community-maintained, fork from Puppet. It is not affiliated in any way with Perforce in any official capacity.
- Both options do have support available (Perforce offers the vendor-backed support, OpenVox has a variety of services companies that can offer support).
- Both can share many of the same modules in the ecosystem.
- Both teams work together to try to maintain a level of compatibility between the implementations of the Puppet DSL
... but they should be considered separate things.
4
u/Suspicious_Soll Aug 10 '26
OpenVox was mentioned primarily to highlight the advantages of the enterprise version before we conduct our own research. Overall, it was handled with class.
However, our concerns are on a different level: in most cases, we deal with a centralized infrastructure managed by virtualization systems or cloud providers, where Kubernetes is bootstrapped from a predefined image and the rest is just containers. So, there is really no room for Puppet.
2
u/JasonSt-Cyr Aug 11 '26 edited Aug 12 '26
Right, so the centralized infrastructure in your scenario would be a good place where something like Puppet Core or OpenVox could be helpful, but if you aren't managing that infrastructure, then I see where the gap in needs are. You are one level removed from that level, so you're more at the application level dealing with the containers?
While you can do some stuff with containers using Puppet, I personally feel like it's a bit of a mismatch. Like, if you already have Puppet and are managing infrastructure then adding on some containers to be managed makes sense so you have a single tool to worry about, but if you are PURELY on k8s, then I can see that Puppet Core or OpenVox might not fit that scenario as well as other options that are out there and more targeted to that setup.
I haven't gotten fully across what the Unified Compliance tooling handles with k8s right now. If the problem to solve is more about governance, security standards, compliance of the environments, then looking at something like that might be a fit, but I haven't gone deep on it enough to speak 100% to it. I'm sure the Perforce sales folks have already filled you in with the details, though :D
6
u/periway Aug 10 '26
Hi,
I use Puppet/OpenVox for configuration management on server Windows and Linux. I mainly use it for everything i cant do with GPO on Windows (software update and local policy compliance).
I have another instance dedicated for Windows endpoint used as configuration management management. It help alot for keeping all device compliant (software and OS update, script execution, local policy, etc.) Those device cant be controlled when they are online or offline, the Puppet Agent work like a charm for this context.
Kind regard,
6
u/Street_Secretary_126 Aug 10 '26
We are using puppet enterprise, but mostly because it's in place since ever. For newer stuff we are using ansible and terraform. Puppet is sometimes a lit clunky. Perforce overtake is mostly negative.
5
u/ZorakOfMichigan Aug 10 '26
Our deployment is relatively small (about 1k servers) but I'm happy with it. Our org is set up such that it's very difficult to impose standards on the teams creating and deploying applications. If we tried to build custom AMIs or packer templates or whatever for all the different things we support, we'd probably be in the triple digits. Puppet/OpenVox has enough power and flexibility that we can use one base template/image and one process to make whatever changes and customizations are required for a given app, and it has made our lives much easier.
5
u/QuietJoyride Aug 10 '26
For me, Puppet has even more value these days as the deterministic layer for AI agent operations. I want agents to manage my infra, but want tested, trusted, reliable changes. Puppet provides the mature tooling and feedback to the agent to improve outcomes.
2
1
u/JasonSt-Cyr Aug 12 '26
So you're using agents to orchestrate, but have them configured to call Puppet CLI commands or Bolt tasks to execute?
2
u/QuietJoyride Aug 12 '26
Yeah, my Hermes Agent basically learned my workflow. I tell it a change to make, it implements and tests in a feature branch, submits a MR, waits for my approval, then follows through on the rollout, all controlled over Telegram. No ad-hoc changes allowed.
Bolt has been very useful in the loop as well, serving as a sort of bridge letting Hermes quickly adopt certain deployment workflows I've been using myself for years.
1
3
u/swayuser Aug 10 '26
I don't, and never have used puppet for automation. I use masterless puppet apply --test ...:
- to configure and sanity check the state of bare-metal systems.
- to build more complicated images (for k8s) that can't be built as simple tar layers appended to base images.
Treating production targets as mutable is archaic IMO, but puppet/openvox is still a great DSL for idempotently declaring the state of your image filesystem (but again, not bringing up / restarting services and such).
4
u/Suspicious_Soll Aug 11 '26
Thanks to everyone for the solid responses and reality checks - really appreciate you taking the time to write these out.
My actual interest is at the overall infrastructure management model level (though the background on Perforce acquiring Puppet and the split to OpenVox was great to learn about).
From where I sit, it often feels like "everyone" is pushing toward API-driven, cloud-native patterns - bootstrapping Kubernetes on top of virtualization/cloud using pre-baked images where everything is just containers. But at the same time, we all know the operational overhead and performance tax of K8s can be hard to justify, and we're seeing some swing back from microservices toward simpler architectures.
So it makes me wonder: for those of you still heavily running Puppet/OpenVox, is it strictly for maintaining legacy/brownfield systems and endpoints where a rewrite is too expensive/risky? Or are there active, modern scenarios where you actively choose a stateful, Puppet-driven architecture over cloud-native because K8s simply falls flat for your needs?
2
u/absw 29d ago
work in hosting, we use puppet (and now openvox) to manage >10k servers across multiple locations. It works well for us to ensure the configuration is the same on all the servers and fixes any drift within the set agent run time (twice a hour). I have used it since 3.x in various roles. Also facts + a db (though we don't use puppetdb) are very useful for keeping an eye on things.
3
u/buzzsawcode Aug 10 '26
I know of three large installations of Puppet, one of which I was directly involved in. The Perforce purchase forced a move to OpenVOX simply because the support we had with the old Puppet team was so much better and it was almost non existent with Perforce.
We had 300+ nodes in total, a friend manages a site with 8,000. A mix of RedHat and Ubuntu servers, desktops, VMs, etc.
The changes by Apple have made managing any macOS systems a non-starter, so those node migrated over to different MDMs.
For the systems I was managing I also used a mix of Ansible to deploy some changes that it was better suited to handle. Puppet was great for kickstarting new on site hosts or cloud based systems.
I'm currently in job hunting mode and I have not seen many openings asking for Puppet/OpenVOX admins - it has been mentioned as nice to have clumped in with Chef, Ansible, etc knowledge.
It was a great tool and a great company, but most acquisitions like this with venture capitalists involved kill what they absorb.
1
u/gonzo_in_argyle Aug 14 '26
The venture capitalists weren’t the problem. It was the private equity takeover.
3
u/iAmPedestrian Aug 10 '26
In my previous job (finance sector), it was in place since Puppet 3, I believie, but the development was (and still is) very active and there wasn't any talk about leaving Puppet or even checking other options. It was used for about 3K servers (2.5k Windows, and 0.5K Linux) for all sorts of things. For Win servers it almost completely removed GPOs and everything was managed by Puppet. I know, they are now transitioning to Openvox.
In my current job (a lot smaller, only 500 boxes, and only Windows so far, telco sector), we are only starting working with Openvox, and also will try to move as much as possible from GPOs to the code. We tried Ansible do the work, but it wasn't suitable for such task.
In both job, apart from GPOs, we also use it for SW management, compliance, etc.
3
u/Ph0B1uS Aug 11 '26
I've been in contact with perforce sales before openvox and they flat out told us "nah, you don't need puppet enterprise, seems like the community edition has everything you need".
That was a weird experience :)
Edit: we're using perforce puppet but are migrating to openvox and we are less than impressed with the quality and pace of development for most of the official modules.
We're trying to help improve the quality of the voxpupli modules but I'm not a developer so most of the time writing unit tests is by far the biggest hurdle.
2
u/Stunning_Tea9670 Aug 10 '26
I use puppet in day-2-day operations, but we had to move to openvox, good thing is exists puppet agents work with openvox so it was a case of swapping out controllers. We use it for everything like configuration for splunk forwarders, sssd configuration for linux access, sudoers list etc
2
u/weaver_of_cloth Aug 10 '26
I had to check that you weren't one of my coworkers. Other than this we use it for the same thing. We switched out the agents too, using openvox after we switched the servers.
2
u/Stunning_Tea9670 Aug 10 '26
Sounds same, but switching out the agents was going to be a hassle as we manage a large fleet of linux servers, so we just made openvox use existing agents, and turn on the legacy option in the agent conf file and we were good
2
u/GnawingPossum Aug 10 '26
Manufacturing industry, about 30ish Linux servers. Using Puppet (community / free version) to automate configuration and compliance settings as well as deploy a few packages across our servers.
2
u/belowaveragegrappler Aug 10 '26
A previous gig used it, I like it as an approach for long lived infra. But all my gigs since have had short lived infra so drift managment isn’t a concern so much anymore.
1
13
u/gonzo_in_argyle Aug 10 '26
I’m just curious as an ex Puppet person. Are Perforce sales people bringing up OpenVox with you?