Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk10 min

How to Set Up a Masterless Puppet Environment on Ubuntu

Set up masterless Puppet on Ubuntu with a local production environment, explicit modulepath, offline dependency handling, safe no-op previews, detailed exit codes, and external scheduling.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To run Puppet without a master, install the Puppet agent package on each Ubuntu node, keep a versioned environment locally, and execute manifests with puppet apply. Each run compiles and applies a catalog on that node, writes a report, and exits; it is a foreground, one-shot command rather than a daemon. You must therefore provide your own code distribution, scheduling, reporting, dependency management, and secret delivery.

This design is supported for Ubuntu 22.04, 24.04, and 26.04 package targets on the x86_64 and ARM architectures listed by Puppet. The procedure below uses a production environment at /etc/puppetlabs/code/environments/production, with a local module tree and a manifest that can be previewed before enforcement.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What masterless Puppet is—and what it is not

Masterless Puppet means running puppet apply directly on every managed node. Puppet describes it as “the standalone Puppet execution tool” for applying individual manifests. The command compiles a catalog, applies resources, writes a report, and exits. It does not remain resident as a service.

By default, a puppet apply run does not initiate outbound network connections or accept inbound connections. That reduces network dependence and exposure, but it also removes services a primary-server design would normally provide. A masterless deployment must arrange these responsibilities separately:

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
  • Distribute the manifest and module revision to each node.
  • Schedule runs with cron, a systemd timer, CI, or another scheduler.
  • Collect reports and alert on failed runs.
  • Provide module dependencies and required data, including secrets, locally or through an explicitly managed mechanism.
  • Control Puppet package and module versions so nodes do not drift unexpectedly.

It is therefore not a smaller Puppet server. It is local, one-shot execution repeated by an external process.

Check Ubuntu and architecture support first

Puppet’s current supported-agent table lists Ubuntu 22.04, 24.04, and 26.04 package targets, with x86_64 and ARM architectures shown for those releases. Confirm both values before installing anything; an otherwise correct package can still be unsuitable for the node’s release or CPU architecture.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Record the Ubuntu release running on the node.
  • Record whether the machine uses x86_64 or one of the listed ARM architectures.
  • Select the Puppet package built for that release and architecture.
  • Pin the package version used by your fleet instead of allowing uncontrolled upgrades.
  • Verify package signatures when your organization’s security or change policy requires it.

Use Puppet’s current Ubuntu installation guidance to configure the package source and install the matching agent package. The exact repository instructions can change as supported releases and package versions change, so do not copy an installation command intended for a different Ubuntu release.

Create a local code environment

A predictable directory tree makes the command line, version control, and automation agree about which code is being applied. One practical layout is:

/etc/puppetlabs/code/
└── environments/
    └── production/
        ├── manifests/
        │   └── site.pp
        └── modules/

The main manifest is /etc/puppetlabs/code/environments/production/manifests/site.pp. Put reusable modules in the neighboring modules/ directory. Keep this entire environment in source control, including a lock or other record of module versions where your workflow supports it, and distribute the same revision to every node that is meant to have identical configuration.

The manifest can be supplied on the command line, as in the examples below, or passed inline with -e. Puppet also uses settings such as basemodulepath and the selected environment to locate code and data. Supplying the manifest path explicitly is useful in a masterless setup because it makes a scheduled command unambiguous.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Install modules for online and offline nodes

Online nodes

When a node can reach the Puppet Forge, install a module with:

puppet module install <author>-<module>

The command installs the module and its dependencies into the first modulepath directory by default. Confirm that this is the environment you intend to use; installing into a different modulepath can leave site.pp unable to find the code even though the installation appeared to succeed.

Offline nodes

An isolated node cannot resolve dependencies automatically. Move the required module tarball to the node, install it locally, and provide every dependency through the same offline process. Test the complete dependency closure before promoting the bundle to production. A tarball that contains only the top-level module is not sufficient if that module declares other modules.

Make modulepath precedence explicit

For troubleshooting or controlled rollouts, pass the modulepath directly:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
--modulepath=/etc/puppetlabs/code/environments/production/modules

On Unix, modulepath entries are ordered and colon-separated. If two entries contain a module with the same name, Puppet uses the copy in the earlier directory. This precedence can explain why a node appears to run an older implementation after a new module was copied elsewhere. Keep the path short and explicit in automation when multiple environments or module trees exist.

Write the main manifest

Create /etc/puppetlabs/code/environments/production/manifests/site.pp. This minimal example asks Puppet to install Nginx and manage a message-of-the-day file:

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
# /etc/puppetlabs/code/environments/production/manifests/site.pp
package { 'nginx':
  ensure => installed,
}

file { '/etc/motd':
  ensure  => file,
  content => "Managed by masterless Puppetn",
}

The manifest is intentionally local: it does not require a server to compile a catalog. As you add modules, keep node-specific data and sensitive values in the data mechanism you have chosen, and ensure each node can access the data at run time. Local execution does not remove the need to protect secrets; it moves that responsibility to every node and to the process that distributes its code.

Preview the first run with no-op mode

Always preview a new manifest or module revision before enforcing it. Run:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo puppet apply --noop --modulepath=/etc/puppetlabs/code/environments/production/modules /etc/puppetlabs/code/environments/production/manifests/site.pp

--noop reports the changes Puppet intends to make without enforcing them. Review package, file, service, and command changes in the output. A no-op run is also a useful check that the manifest parses and that the selected modulepath resolves the classes and defined types it references.

  • Check that the package action is the expected install, update, or no-change result.
  • Check file paths, ownership, modes, and content before allowing a replacement.
  • Look for unexpected resources that come from a module dependency.
  • Investigate catalog compilation errors instead of treating a partial output as safe.

No-op mode is a preview, not a substitute for a successful enforcing run. It can show intended changes while leaving the node untouched.

Enforce the catalog and capture useful exit codes

After reviewing the preview, remove --noop and run the same manifest:

sudo puppet apply --modulepath=/etc/puppetlabs/code/environments/production/modules /etc/puppetlabs/code/environments/production/manifests/site.pp

For automation, add --detailed-exitcodes:

sudo puppet apply --detailed-exitcodes --modulepath=/etc/puppetlabs/code/environments/production/modules /etc/puppetlabs/code/environments/production/manifests/site.pp

With detailed exit codes, automation can distinguish an unchanged successful run from one that made changes and from failures:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Code Meaning Automation response
0 Successful run with no changes. Mark the run healthy and unchanged.
2 Successful run that made changes. Mark the run healthy; record the change event.
1, 4, or 6 Failure outcomes; the exact value depends on the failure and whether changes also occurred. Alert or fail the job, then inspect Puppet output and reports.

Do not write a scheduler that treats every nonzero result as identical. Code 2 is a successful, changing run; failure codes require investigation. Preserve the command output and report so you can identify whether the problem was catalog compilation, a resource action, a missing dependency, or unavailable data.

Schedule one-shot runs

Because puppet apply exits after one run and never runs as a daemon or service, an external scheduler must invoke it repeatedly. Common choices are:

  • Cron: simple recurring execution on a node; capture stdout, stderr, and the detailed exit status.
  • Systemd timer: provides service and timer units, dependency ordering, and journaled output.
  • CI or orchestration: useful when a central pipeline distributes a known revision and triggers nodes in controlled batches.

Whichever scheduler you choose, call the same explicit manifest and modulepath used during testing. Ensure only one run operates on a node at a time, retain logs, and alert on Puppet failure codes. Scheduling cadence is an operational choice; Puppet itself does not supply it in masterless mode.

Distribute manifests, modules, and data

A primary-server design normally centralizes code delivery and catalog compilation. In a masterless design, select and document your replacement:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Commit the environment, manifests, module metadata, and dependency versions to source control.
  2. Build a release artifact or package containing the exact tree required by the node.
  3. Deliver that revision through your approved Git, package, image, configuration-management, or CI mechanism.
  4. Install modules into the intended modulepath and verify dependency closure, especially for offline nodes.
  5. Run --noop and then the enforcing command on a test node before broad rollout.
  6. Record which revision each node has applied and retain the detailed exit status.

Do not assume that copying site.pp alone is enough. Puppet resolves modules and data through the environment and modulepath, so a node missing a module or a declared dependency can fail before it changes anything.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Masterless versus a primary-server design

The choice is operational rather than a claim that one mode is universally better. The following comparison reflects how the documented execution behavior affects day-to-day administration.

Concern Masterless execution Primary-server design
Catalog compilation Each node compiles and applies its own catalog with puppet apply. A central Puppet service commonly compiles catalogs for nodes.
Scheduling External cron, systemd timers, CI, or another scheduler is required. Scheduling and check-in are commonly coordinated through the server/agent model.
Network exposure By default, the apply command neither accepts inbound connections nor initiates outbound network connections. Nodes generally communicate with the primary server, so network reachability and server protection are required.
Code and module distribution You must distribute the environment and dependencies to every node. The server provides a central source for catalogs and commonly for code.
Reporting Collect and centralize local reports yourself. Central services can provide a shared reporting and orchestration point.
Secrets and data Every node needs access to the data its local manifest requires. Secret and data access can be concentrated in server-side workflows, subject to their own controls.
Fleet scale Works well when local autonomy or weak connectivity matters, but distribution and observability grow with node count. Usually easier to coordinate across a large fleet, at the cost of central infrastructure and network dependency.

Masterless is a strong fit for disconnected, edge, image-based, or deliberately self-contained systems. A primary server is often preferable when centralized orchestration, uniform reporting, and large-fleet coordination outweigh the benefits of local independence.

Troubleshoot common failures

“Could not find” a class, define, or module

Check the modulepath first. Confirm the module exists under the environment’s modules/ directory, then run with the explicit --modulepath shown above. If several module directories are specified, remember that the first matching directory wins.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The module installs but its dependency is missing

On an online node, resolve and install the declared dependency. On an offline node, add the dependency tarball and install it as part of the same bundle. Re-test dependency closure before distributing the bundle to other isolated nodes.

No-op succeeds but enforcement fails

Compare the no-op and enforcing commands character for character. Confirm that the enforcing run uses the same manifest, modulepath, user privileges, and data. No-op does not perform the changes, so a real permission, package-manager, filesystem, or service error can appear only during enforcement.

The scheduler reports a failure but the node changed

Use --detailed-exitcodes and preserve the report. Exit code 6 can represent a run that both changed resources and encountered failures; do not automatically roll back changes. Inspect the failed resources, correct the manifest or node condition, and run again after reviewing a fresh no-op preview.

An offline node cannot obtain required data

Masterless execution does not provide a remote data channel. Package the non-secret data with the release where appropriate, and establish a controlled local or pre-provisioned method for secrets. Verify access under the account that the scheduler uses, not only under an interactive administrator account.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Production checklist

  • Ubuntu release and architecture match a supported Puppet package target: 22.04, 24.04, or 26.04, on a listed x86_64 or ARM architecture.
  • Puppet package version is pinned, and signatures are verified according to policy.
  • Manifests, modules, dependency versions, and data-handling rules are in source control.
  • The environment uses the intended production/manifests/site.pp and modulepath.
  • Online modules include all dependencies; offline bundles have been tested for complete dependency closure.
  • Every new revision receives a --noop review before enforcement.
  • Schedulers invoke the explicit manifest and modulepath and prevent overlapping runs.
  • Detailed exit codes are captured; code 2 is treated as a successful change, while 1, 4, and 6 trigger investigation.
  • Reports and logs are retained centrally enough to identify which node, revision, and resource failed.
  • Each node can access the secrets and other data required by its manifest without exposing them unnecessarily.

Key operating principles

Remember five properties when designing the environment: masterless Puppet is local puppet apply, not a reduced Puppet server; execution is foreground and one-shot; scheduling and code distribution are external; modulepath order decides which duplicate module implementation is loaded; and no-op previews plus detailed exit codes make rollouts safer and observable. If your team can operate those surrounding systems reliably, Ubuntu nodes can enforce Puppet code without a primary server.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.