Skip to main content

Puppet

Visualize Visualize Puppet infrastructure, including servers, nodes, catalog, environment, factsets, and resources, and monitor changes through queries and alerts.

Installation Guide

info

Puppet consists of the Puppet Server, which manages configurations, Puppet Agents, which apply them on nodes, and PuppetDB, which stores configuration, state, and report data. This integration connects to PuppetDB and reads node, environment, fact, resource, and catalog data from it. The integration requires client certificates signed by Puppet's Certificate Authority (CA) for mutual TLS authentication.

Requirements​

  • Network connectivity between the JupiterOne integration and PuppetDB.
  • PuppetDB installed and configured: Install PuppetDB
  • PuppetDB connected to the Puppet Server: Connect PuppetDB and Puppet Server
  • client-auth set to need (or want) in PuppetDB's jetty.ini so that TLS client certificates are required.

Configuration in Puppet​

Generate a Client Certificate​

  1. Connect to the Puppet Server using SSH.

  2. Run the following command to generate a certificate and key pair:

    puppetserver ca generate --certname <Certificate-Name>
    # For example: j1-integration-cert

  3. Verify that the certificate was generated and signed by the CA:

    puppetserver ca list --all

  4. Collect the following files — you will upload them when configuring the integration in JupiterOne:

    • Certificate Authority Certificate: /etc/puppetlabs/puppet/ssl/certs/ca.pem
    • Client Certificate: /etc/puppetlabs/puppet/ssl/certs/<Certificate-Name>.pem
    • Client Certificate Private Key: /etc/puppetlabs/puppet/ssl/private_keys/<Certificate-Name>.pem

Configuration in JupiterOne​

  1. From the top navigation bar of the J1 Search homepage, go to Integrations.

  2. Search for Puppet and select it.

  3. Click Add Instance and configure the following settings:

    • PuppetDB URL: The IP or hostname where PuppetDB is reachable (for example, https://127.0.0.1).
    • PuppetDB Port: The port PuppetDB listens on for SSL connections (default: 8081).
    • Certificate Authority Certificate: The CA certificate file (ca.pem).
    • Client Certificate: The client certificate file (for example, j1-integration-cert.pem).
    • Client Certificate Private Key: The private key file for the client certificate.
    • Account Name: A name to identify this Puppet instance in JupiterOne. When Tag with Account Name is enabled, ingested entities store this value in tag.AccountName.
    • Description: An optional description to help identify this integration instance.
    • Polling Interval: How frequently data is refreshed. Leave as DISABLED to trigger runs manually.

  4. Click Create Configuration to save.

Data Volume Configuration​

Advanced Configuration​

FieldDescriptionDefaultOptions
Resource Types FilterLimits ingestion to specific Puppet resource types. When no types are selected, all resource types are ingested, including custom module-defined types not listed here (for example, Firewall or Apache::Vhost).(all types)Package, Service, User, Group, File, Cron, Exec, Ssh_authorized_key, Mount, Host, Yumrepo, Scheduled_task, Selboolean, Selmodule, Augeas

Troubleshooting​

BAD Certificate Error​

This error occurs when the provided CA certificate is malformed or does not match the certificate chain. To regenerate certificates on the Puppet Server:

# Back up existing certificate files
cp -r /etc/puppetlabs/puppet/ssl /etc/puppetlabs/puppet/ssl_back

# Remove the existing certificates
rm -rf /etc/puppetlabs/puppet/ssl

# Regenerate the CA certificate
puppetserver ca setup

# Restart the Puppet Server
systemctl restart puppetserver

No Alternative Certificate Subject Name Matches Target Hostname​

This error occurs when the certificate's common name does not match the hostname in the PuppetDB URL.

  1. Open the Puppet configuration file:

    nano /etc/puppetlabs/puppet/puppet.conf

  2. Under the [main] section, set certname to match the hostname used in the PuppetDB URL:

    [main]
    certname = <hostname>

  3. Restart the Puppet Server:

    systemctl restart puppetserver

Next Steps​

Once the integration instance is configured, it will run on the polling interval you set and populate Puppet data in JupiterOne. Continue to the Instance Management Guide to learn more about working with integration instances.