Take the 2-minute tour ×

Is it possible to setup puppet in a way that changes in manifests only will be applied during certain hours, so that any eventual downtime on our server will occur when we decide it to?


share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

I just had to solve this problem... There are a few approaches...

  • Use cron. If you have an OS that supports cron.d entries, distribute a puppet.cron file via Puppet. The accompanying manifest would have something that ensures that the Puppet daemon is off. If you have a lot of servers, use a bash function to randomize the cron pull time to reduce the load on the master server. Also see the Puppet wiki on this topic.

The module I use:

class puppet_cron {

   file { '/etc/cron.d/puppet.cron':
     ensure   => file,
     owner    => root,
     group    => root,
     mode     => 644,
     source   => "puppet:///modules/puppet_cron/puppet.cron",

   service { 'puppet':
     ensure    => stopped,
     enable    => false,


An example puppet.cron:

# puppet.cron
# Run puppet in one-time mode during daily downtime window.

# Puppet check window for Monday through Thursday
*/15 16-19 * * 1-5 root exec /usr/sbin/puppetd --no-daemonize -o
  • There's a Puppet schedule metaparameter that allows you to list times when manifests should be evaluated on a per-class basis. See: http://serverfault.com/a/341865/13325

  • I recently read a book that suggested using Git as a manifest distribution method in order to scale and reduce the load on the master server. This means you'd have more granular control over scheduling.

share|improve this answer
You don't need to use a bash function to randomize the time -- that's what the fqdn_rand() Puppet function is for. –  jgoldschrafe Mar 17 '12 at 15:00
@ewwhite can link me to the git post? –  Cherian Aug 6 '12 at 10:54
@Cherian The process is described in this article, but also covered in detail in the author's book, The Puppet Cookbook. –  ewwhite Aug 6 '12 at 12:37
add comment

Yes, just setup the cronjob that runs puppet to only run during certain hours. Running puppet as a daemon is a really terrible idea. We use the IP address of the server as the key into a hashing function to splay our cronjobs across the entire time period of our Puppet runs, to avoid a thundering herd problem.

share|improve this answer
add comment

Your Answer


