Puppet 9 upgrade considerations
Puppet Enterprise 2026.x supports Puppet 9 agents. Before upgrading agents to Puppet 9, review the following information and plan accordingly.
This page highlights changes that might affect PEPE deployments. For complete information about Puppet 9 changes, deprecations, and removals, see the Puppet Core documentation.
Review supported operating systems
Puppet 9 introduces updates to underlying platform components. Before upgrading to Puppet 9, review custom code, modules, facts, and other dependencies for compatibility.
-
For information about the component versions included with your PE release, see Component versions in recent PE releases.
-
For complete information about Puppet 9 component changes and compatibility considerations, see the Puppet Core upgrade documentation.
Update custom facts
Ruby 4.0 no longer supports opening subprocesses with Kernel.open by passing |. For example, the following pattern is no longer supported:
open('| <command>') { |pipe| ... }
If custom facts use this pattern, replace it with an appropriate IO method as described in the Puppet Core documentation.
Review OpenSSL compatibility
Puppet 9 introduces changes related to OpenSSL. Review the Puppet Core documentation for information about OpenSSL compatibility requirements and changes.
Deferred functions are pre-processed by default
In Puppet 8, preprocess_deferred was set to false by default.
In Puppet 9, preprocess_deferred is set to true by default, which restores the behavior used in Puppet 7.
If you rely on deferred function dependencies being run when the catalog is applied, refactor your code to work with the updated setting
Review FIPS changes
Puppet 9 uses the OpenSSL 3.1.2 FIPS provider.
Puppet 8 continues to use the OpenSSL 3.0.9 FIPS provider.
For additional information about FIPS-enabled deployments, see FIPS-enabled PE.
Related information
For complete information about Puppet 9 changes, see: