Puppet bridge reference information

Supported Puppet Enterprise (PE) versions

The Puppet bridge is supported by the following PE versions:

  • Puppet Enterprise 2025.0 and later

  • Puppet Enterprise 2023.8 and later

Components

The Puppet bridge includes the following components:

Component Description
pf-bridge Connects to the Perforce Unified Compliance platform, receives commands over Server Sent Events (SSE), sends requests to pe-adapter, and returns results to the Perforce Unified Compliance platform.
pe-adapter Receives requests from pf-bridge, queries PuppetDB, and returns the results.
pe-bridge-cli Command-line tool that extracts the configuration bundle provided by the Perforce Unified Compliance platform, generates the required certificates, writes configuration files, and manages the associated systemd services.

Ports

The following ports are used by the Puppet bridge services:

Port Service Binding Protocol Description
8443 pf-bridge localhost HTTPS Used for communication between Puppet bridge components.
8444 pe-adapter localhost HTTPS Used for communication between Puppet bridge components.

Both service ports can be configured using the pe-bridge-cli init flags (--bridge-port and --adapter-port).

By default, both services bind to localhost only and do not expose external listeners.

Outbound network requirements

The Puppet bridge components require outbound HTTPS (mTLS) connections to the Perforce Unified Compliance platform and Puppet services.

pf-bridge

pf-bridge establishes outbound connections to the following Perforce Unified Compliance endpoints:

  • Registration endpoint – A onetime POST request made during the initial startup.

  • SSE endpoint – A long-lived ServerSent Events (SSE) connection used to receive commands.

  • Submission endpoint – POST requests used to send results back to the Perforce Unified Compliance platform.

pe-adapter

pe-adapter makes outbound HTTPS connections to:

  • PuppetDB (default port 8081) – Used to query node facts, catalogs, and reports.

  • Puppet Server (port 8140) – Used to query the Puppet version and service status.

Both components use the Puppet CA for certificate verification.

Ensure that firewall rules permit outbound HTTPS traffic from the Puppet bridge host to the Perforce Unified Compliance platform, PuppetDB, and Puppet Server.

Estimated resource requirements

The following are approximate resource requirements for the Puppet bridge services:

Resource pf-bridge pe-adapter Combined
RAM ~50 MB ~50 MB ~100 MB
CPU < 0.5 core < 0.5 core < 1 core
Disk ~50 MB ~50 MB ~100 MB

These values represent baseline estimates for typical workloads. Actual consumption depends on factors such as event volume and the size of PuppetDB responses.

Both services use bounded worker pools (8 workers each by default) and a work queue (capacity 200 for pe-adapter), which cap the amount of concurrent work they process.

The disk estimate includes binaries, configuration files, and certificates. Log files are not included and should be planned for separately. Both services write structured JSON logs to /var/log/perforce/. Log volume scales with throughput: under typical workloads, expect low single-digit MB per day, but high-traffic environments can generate significantly more. Log rotation (for example, via logrotate) is enabled by default.

System requirements

The Puppet bridge components require the following system environment:

  • Operating system: Linux distribution with systemd for service management.

  • TLS: TLS 1.2 or later (TLS 1.3 is supported).

  • PuppetDB: Must be accessible over HTTPS (port 8081 by default).

  • Puppet CA: Read access to the Puppet CA certificate.
    Default location:
    /etc/puppetlabs/puppet/ssl/certs/ca.pem
    This path can be overridden using the --pe-ca flag.

File locations

The Puppet bridge uses the following file and directory locations:

Path Description
/etc/perforce/pf-bridge/pf-bridge.yaml Configuration file for the pf-bridge service.
/etc/perforce/pe-adapter/pe-adapter.yaml Configuration file for the pe-adapter service.
/etc/perforce/*/ssl/ Directory containing TLS certificates and private keys for each service.
/var/log/perforce/ Directory containing structured JSON log files.
/opt/perforce/ Data directory used by Puppet bridge services.