topic Re: Puppet Master -> Puppet Agent Communication in Tools

Puppet Master -> Puppet Agent Communication

Mitrixsen — Mon, 14 Jul 2025 13:39:09 GMT

Hello, everyone.

I am studying for my ENCOR exam so I really only need to know the basics regarding orchestration tools (ansible, puppet, chef, saltstack). My question is, what exactly do Puppet agents use to communicate with the Puppet Master and pull the configuration from it? The official website says that it can use HTTPs over port 8140 but my book also mentions this:

So can Puppet also use SSH or what exactly does it leverage for the communication?

My second question is -> Puppet uses a pull-model (the devices communicate with the Puppet master and retrieve the configured manifests/catalogs from it). If I was to suddenly create my own catalog file, how will the devices know that they should talk to the Puppet Master and retrieve the catalog from it? Are they notified about the new catalog somehow, or?

Thank you!
David

Re: Puppet Master -> Puppet Agent Communication

Torbjørn — Mon, 14 Jul 2025 13:57:20 GMT

The cisco_ios module should be installed on a proxy agent that manages Cisco IOS & IOS-XE devices. This way you don't have to run the agent on the devices themselves. The proxy agent uses SSH to manage the devices. See the Github repo for the module for more information: https://github.com/puppetlabs/cisco_ios

The agent checks in periodically. AFAIK there is no mechanism to notify the agent of changes.

Re: Puppet Master -> Puppet Agent Communication

bigevilbeard — Mon, 14 Jul 2025 14:39:57 GMT

You are right yes. Puppet agents communicate with the puppet master on https and the puppet master, though can use various protocols, including ssh (which i think the book is referring too), to apply the desired state to the end devices it might be managing, this therefore allow options depending on the device type and the puppet module being used.

Second one, correct again (top points) puppet uses a time based pull model by default. Say you made a new catalog or updated a new one, when the next pull happens (i think this is default 30 minutes) they will apply the changes/new config etc.. however you can manually trigger an immediate run. But the end devices are not notified they have changes, they discover changes when they perform their next scheduled check in. So its a pull, not a push.

Hope this help, and your study is going well!