Table of contents
1.
Introduction
2.
Upgrade Puppet Enterprise
2.1.
Configure a non-production environment for infrastructure nodes
2.2.
Upgrade a standard installation
2.3.
Upgrade a large installation
2.4.
Upgrade a standalone Puppet Enterprise - PostgreSQL installation
3.
Migrate Puppet Enterprise
3.1.
Migrate a standard installation
4.
Upgrading Puppet Enterprise Agents
4.1.
Upgrade agents using the puppet_agent module
4.2.
Upgrade agents using a script
4.2.1.
Upgrade a *nix agent using a script
4.2.2.
Upgrade a Windows agent using a script
4.3.
Upgrade agents without internet access
4.4.
Setting agent versions
5.
Frequently Asked Questions
5.1.
What is the difference between Puppet and Ansible?
5.2.
What is Puppet Forge?
5.3.
Is Puppet a configuration management tool?
6.
Conclusion
Last Updated: Aug 13, 2025
Medium

Upgrading Puppet Enterprise

Author Nagendra
0 upvote
Career growth poll
Do you think IIT Guwahati certified course can help you in your career?

Introduction

Hey Ninjas!! Welcome to another article on Puppet. Today we will learn about Upgrading Puppet Enterprise. Puppet Enterprise allows users to understand the configuration of your infrastructure. It includes all physical components of your data center, cloud infrastructure, and everything running in containers. Puppet automatically maintains the appropriate working state while giving you full authority to make required changes. This ensures consistency and keeps you in compliance.

Upgrading Puppet Enterprise Image

Without further ado, let's get started.

Upgrade Puppet Enterprise

You can easily upgrade your Puppet Enterprise infrastructural components. Upgrades are required to ensure that all infrastructure nodes are working properly. 

Configure a non-production environment for infrastructure nodes

You can manually configure PE to use your preferred Environment before upgrading. This is beneficial when infrastructure nodes are not in a production environment.

  • In pe.conf, set both of the parameters to the Environment in which your infrastructure nodes are located:
pe_install::install::classification::pe_node_group_environment 
puppet_enterprise::master::recover_configuration::pe_environment

 

  • Execute the Command: 
puppet-enterprise-installer -- --pe-environment <env>

Upgrade a standard installation

Follow the following steps to upgrade a standard installation:

  • Download the tarball for your operating system.
     
  • Execute the command:
tar -xf <TARBALL> 

 

This command unpacks the installation tarball.
 

  • From the installer directory on your main server, run the command:
sudo ./puppet-enterprise-installer 


This command starts the installer.

  • Follow the CLI instructions to finish your server upgrade.
     

If the pe.conf file is different from the existing file, use the -c flag.

Command:

sudo ./puppet-enterprise-installer -c <FULL_PATH_TO_pe.conf>


This flag will tell the installer to back up the last used ‘pe.conf’ file to ‘/etc/puppetlabs/enterprise/conf.d/<TIMESTAMP>.conf’. Create a brand new ‘pe.conf’ file at ‘/etc/puppetlabs/enterprise/conf.d/pe.conf’.

  • Upgrade the following additional PE infrastructure components:
    • Agents
       
    • Puppet Enterprise client tools: You must reinstall the client tools version corresponding to the Puppet Enterprise version. The Client tools on managed and infrastructure nodes are automatically updated.
       
  • Upgrade your replica in disaster recovery installations.

 

During this step, the replica is temporarily unavailable to serve as a backup. So, upgrade your replica as fast as possible to minimise the risk.

  • Run the following command your main server logged in as root.

Command:

sudo puppet infrastructure upgrade replica <REPLICA_FQDN>

 

  • If you want to mention an authentication token other than the default, run the following command:

Command:

sudo puppet infrastructure upgrade replica <REPLICA_FQDN> --token-file <PATH_TO_TOKEN>

 

  • Then verify that primary and replica services are operational. 

Command:

sudo /opt/puppetlabs/bin/puppet-infra status

 

  • If your replica shows errors, then reinitialize the replica. On your replica, run the command:
sudo /opt/puppetlabs/bin/puppet-infra reinitialize replica -y

 

  • By default, all packages older than the current version are removed. To remove particular versions, append pe_version=<VERSION_NUMBER> to the command.

Upgrade a large installation

Follow the following steps to upgrade a large installation:

  • Download the tarball for your operating system.
     
  • Execute the command:
tar -xf <TARBALL> 

 

  • This command unpacks the installation tarball.
     
  • From the installer directory on your main server, run the command:
sudo ./puppet-enterprise-installer 

 

  • This command starts the installer.
     
  • Follow the CLI instructions to finish your server upgrade.
     

Use the command for a different pe.config file:

sudo ./puppet-enterprise-installer -c <FULL_PATH_TO_pe.conf>


This flag will tell the installer to back up the last used pe.conf file to /etc/puppetlabs/enterprise/conf.d/<TIMESTAMP>.conf. Create a brand new pe.conf file at /etc/puppetlabs/enterprise/conf.d/pe.conf.

  • For upgrading the compilers, log in to your main server as root and run one of the following commands:
     
  • The following command upgrades specific compilers:
sudo puppet infrastructure upgrade compiler <COMPILER_FQDN-1>,<COMPILER_FQDN-2>

 

  • The following command upgrades all compilers simultaneously:
sudo puppet infrastructure upgrade compiler --all

 

  • You can include --token-file <PATH_TO_TOKEN> in the command. It is used to mention an authentication token location other than the default location. Example:
sudo puppet infrastructure upgrade compiler <COMPILER_FQDN> --token-file <PATH_TO_TOKEN>

 

  • Upgrade the following additional PE infrastructure components:
    • Agents
       
    • Puppet Enterprise client tools: You must reinstall the client tools version corresponding to the Puppet Enterprise version. The Client tools on managed and infrastructure nodes are automatically updated.
       
  • Upgrade your replica in disaster recovery installations. During this step, the replica is temporarily unavailable to serve as a backup. So, upgrade your replica as fast as possible to minimize the risk.
  • On your main server logged in as root, run the command:
sudo puppet infrastructure upgrade replica <REPLICA_FQDN>

 

  • If you want to mention an authentication token other than the default, run the command:
sudo puppet infrastructure upgrade replica <REPLICA_FQDN> --token-file <PATH_TO_TOKEN>

 

Then verify that primary and replica services which are operational. 

Command:

sudo /opt/puppetlabs/bin/puppet-infra status

 

  • If your replica shows errors, then reinitialize the replica. Run the command:
sudo /opt/puppetlabs/bin/puppet-infra reinitialize replica -y

 

  • By default, all packages older than the current version are removed. To remove particular versions, append the statement pe_version=<VERSION_NUMBER> to the command.

Upgrade a standalone Puppet Enterprise - PostgreSQL installation

Follow the following steps to upgrade a standalone Puppet Enterprise:

  • Download the tarball for your operating system.
     
  • Execute the command:
tar -xf <TARBALL> 

 

  • This command unpacks the installation tarball.
  • From the installer directory on your main server, run the command:
sudo ./puppet-enterprise-installer 


This command starts the installer.

  • Follow the CLI instructions to finish your server upgrade.
     

Run the following command if pe.conf file is different than the existing file:

sudo ./puppet-enterprise-installer -c <FULL_PATH_TO_pe.conf>


This flag will tell the installer to back up the last used pe.conf file. The backup is stored at:

 /etc/puppetlabs/enterprise/conf.d/<TIMESTAMP>.conf. Create a brand new pe.conf file at the location: /etc/puppetlabs/enterprise/conf.d/pe.conf.
 

  • Log in to your primary server as root.
     
  • Run one of these commands. This will upgrade your compiler.
    • The following command upgrades specific compilers:
sudo puppet infrastructure upgrade compiler <COMPILER_FQDN-1>,<COMPILER_FQDN-2>

 

  • The following command upgrades all compilers simultaneously:
sudo puppet infrastructure upgrade compiler --all

 

  • To specify an authentication token location other than the default location, include --token-file <PATH_TO_TOKEN> in the command.
    Example:
sudo puppet infrastructure upgrade compiler <COMPILER_FQDN> --token-file <PATH_TO_TOKEN>

 

  • Upgrade the following additional PE infrastructure components:
    • Agents
    • Puppet Enterprise client tools: You must reinstall the client tools version corresponding to the Puppet Enterprise version. The Client tools on managed and infrastructure nodes are automatically updated.
       
  • All packages which were older than the current version is removed by default. To remove specific versions, append pe_version=<VERSION_NUMBER> to the command.

Migrate Puppet Enterprise

You can migrate your Puppet Enterprise installation instead of upgrading. Migrating causes little downtime and requires extra system resources. It configures a new primary server.

Migrate a standard installation

Follow the following steps to Migrate a standard installation:

  • Install the most recent Puppet Enterprise version on a new primary server node.
     
  • Make a backup of your current installation.
     
  • You can restore your installation to the new primary server using the backup you created.
     
  • Upgrade your new primary server to the most recent Puppet Enterprise release.
     
  • Change the hostname in puppet.conf on all nodes to the hostname of your new primary server.

Command:

sudo puppet config set server <PRIMARY_HOSTNAME>

Upgrading Puppet Enterprise Agents

The puppet agent module aids in the automation of upgrades. It provides the most secure upgrade. You can also use a script to upgrade individual nodes. You can upgrade Puppet Enterprise Agents by the following ways:

Upgrading Puppet Enterprise Agents Image
  1. Upgrade agents using the puppet_agent module.
     
  2. Upgrade agents using a script.
     
  3. Upgrade agents without internet access.
     

Let's get into details of each of them.

Upgrade agents using the puppet_agent module

You can use the puppet_agent module to upgrade multiple *nix, macOS, or Windows agents simultaneously. The module handles all the latest version upgrades. The following steps Upgrade agents using the puppet_agent module:

  • Download the puppet_agent module.
     
  • Install the puppet_agent module on your primary server.

Command:

 puppet module install the puppetlabs-puppet agent

 

  • Configure the primary server to install the desired agent version.
    • Go to Node groups → PE Infrastructure → PE Master in the PE console.
       
    • On the Classes tab, put the pe_repo in the Add a new class space.
       
    • Select the appropriate repo class from the given list of classes.
       

Repo classes are formatted as:

pe_repo::platform::<AGENT_OS_VERSION_ARCHITECTURE>.

 

  • Click Add class and then commit changes.
  • On your main server, run Puppet to configure the recently assigned class: 

Command:

puppet agent -t

 

A new agent package repo will be created at: 

/opt/puppetlabs/server/data/packages/public/<PE VERSION>/<PLATFORM>/

 

  • Make a node group for agent upgrades.
    • Navigate to Node groups.
       
    • Click on Add a new group.
       
    • Set the Parent name to the name of the classification node group that is this group's parent. Example: All Nodes.
       
    • Enter a Group name that describes the role of the classification node group. Example: agent_upgrade.
       
    • Choose the Operating Environment.
       
    • Do not choose the Environment group.
       
    • Select Add.
       
  • Add membership rules, classes, and variables.
     
  • Create one or more rules on the Rules tab for the addition of the agent nodes that you want to upgrade to this group. 
     
  • Add the puppet_agent class to the agent node upgrade group's Classes tab.
     
  • Click Add class.
     
  • Find the puppet agent class you just created. 
     
  • Set the package version parameter to the puppet-agent package version you want to install.
     
  • Commit the changes.
     
  • You must notify the agent upgrade node group if you change the prefix parameter of the pe_repo class of the PE Master node group. Set one of the puppet agent class's *_source parameters to https://PRIMARY HOSTNAME>:8140/PREFIX> on the agent upgrade node group.
     
  • Puppet should run on the agents you're upgrading. For example: /opt/puppet/bin/puppet agent -t

Results

After the Puppet execution, you can verify the upgrade using the command: /opt/puppetlabs/bin/puppet --version

Upgrade agents using a script

To upgrade the agent on a single node, use a script that runs directly from the node. This method depends on a package repository hosted on your primary server.

Upgrade a *nix agent using a script

The following steps upgrades a *nix agent:

  • Configure the primary server to download the desired agent version.
    • Navigate to Node groups → PE Infrastructure → PE Master in the Puppet Enterprise console.
       
    • Enter pe_repo in Add a new class field on the Classes tab.
       
    • Select the appropriate repo class from the given list of classes.
       
    • The format of repo classes is pe_repo::platform::AGENT OS VERSION ARCHITECTURE>
       
    • Click Add class to save your changes.
       
  • Run Puppet on your primary server to configure the newly assigned class.

Command:

puppet agent -t

 

  • SSH into the agent node that needs to be upgraded.
     
  • Run the following upgrade script command:

Command:

cacert="$(puppet config print localcacert)"
uri="https://$(puppet config print server):8140/packages/current/install.bash"

curl --cacert "$cacert" "$uri" | sudo bash


Results

Puppet Enterprise services will automatically restart.

Upgrade a Windows agent using a script

The following steps upgrades a Windows agent using a script:

  • Stop both the Puppet and the PXP agent services.
     
  • Open PowerShell as an administrator on the Windows agent.
     
  • Run the install script:

Command:

[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}; `
$webClient = New-Object System.Net.WebClient; `
$webClient.DownloadFile('https://<PRIMARY_HOSTNAME>:8140/packages/current/install.ps1', 'install.ps1'); `
.\install.ps1

 

  • Run puppet agent -t to ensure that Puppet runs successfully.
     
  • Restart both the Puppet and the PXP agent services.

Upgrade agents without internet access

Puppet allows users to upgrade agents without internet access. The following steps upgrade agents without internet access:

  • Download the agent tarball.
     
  • If you are installing an agent version other than the one on your primary server, download the agent tarball that corresponds to the agent version parameter for the node's platform.
     
  • Copy the agent tarball to the appropriate agent package directory on your primary server.

Command:

 /opt/puppetlabs/server/data/staging/pe repo-puppet-agent-<AGENT_VERSION>

 

  • In the PE Master node group, declare the agent architecture class:
    • Navigate to Node groups → PE Infrastructure → PE Master in the PE console.
       
    • Enter the pe_repo in the Add a new class space on the Classes tab.
       
    • Select the appropriate repo class from the list of classes.
       
    • The format of repo classes is: pe_repo::platform::<AGENT_OS_VERSION_ARCHITECTURE>.
       
    • Click Add class.
       
    • Commit the changes.
       
  • Run Puppet on your primary server to configure the newly assigned class: 

Command:

puppet agent -t

 

  • Run the following script command to upgrade.

Command:

cacert="$(puppet config print localcacert)"
uri="https://$(puppet config print server):8140/packages/current/install.bash"
curl --cacert "$cacert" "$uri" | sudo bash

 

  • Repeat the above steps to upgrade the remaining agents.

Setting agent versions

When you use the puppet agent module to upgrade agents, you can mention the agent version by putting the package_version parameter on the agent upgrade node group. If your agents always want to run the same version as your primary server, you can specify a specific version or make it auto. Agent nodes will automatically upgrade themselves after a primary server upgrade when it is set to auto. You can also set the package version parameter for the puppet agent class.

Frequently Asked Questions

What is the difference between Puppet and Ansible?

In Ansible, the server sends configurations to the nodes, whereas in Puppet, the client retrieves configurations from the server for immediate deployment.

What is Puppet Forge?

Puppet Forge is a collection of modules produced by Puppet, its collaborators, and the community to assist IT operations professionals in streamlining and accelerating their automation processes.

Is Puppet a configuration management tool?

Yes, Puppet is a configuration management tool used for deploying and configuring servers. 

Conclusion

In this blog, we have extensively discussed the details of Upgrading Puppet Enterprise along with the details of migrating Puppet Enterprise and upgrading Puppet Enterprise Agents.

We hope that the blog has helped you enhance your knowledge regarding Upgrading Puppet Enterprise. You can refer to our guided paths on the Coding Ninjas Studio platform to learn more about DSADBMSCompetitive ProgrammingPythonJavaJavaScript, etc. To practice and improve yourself in the interview, you can also check out Top 100 SQL problemsInterview experienceCoding interview questions, and the Utimate guide path for interviews. Do upvote our blogs to help other ninjas grow. Happy Coding!!

Live masterclass