Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to Puppet, and I am wondering if it is an effective solution for patch/pkg management on Solaris as well as Linux. I am more interested on the Solaris side. So far am unable to locate any relevant documentation. Where can I find documentation on how to handle this?

share|improve this question

Patch management is a very broad topic that can have variables like company policy. Therefore there is no out of the box solution that fits all needs, and therefore, puppet only comes with the tools to create solutions that match your specific requirements.

For Rpm or Apt based Linux, all you need is custom repositories, which can be created by rsync, or mrepo, or Satellite or Pulp. Then use puppet to point your servers to these repositories. Puppet can then use Rpm or Apt to manage packages for you. (Check other pages on that site)

Pulp also lets you track what RPM packages are present on what servers, and install them remotely. You could use puppet to install and configure Pulp on your servers. Pulp is a new and not so mature product btw. The features that pulp offers could by built using puppet with some thought and effort.

For Solaris, if it's an individual package, you could use the "pkgadd" provider.

To selectively install multiple Solaris patches, or to install "all the latest" patches, you could use an external script along with puppet "Exec".

There is a popular open source script that people use to manage patches on Solaris. PCA. With PCA, you can create internal mirrors of Sun patches, and configure servers to use those mirrors, instead of going out to the internet.

For installing Solaris packages, you can use the "bldcat" tool from OpenCSW to build internal package repositories. Then you can use "pkgutil" in Puppet to install your internal (and CSW) Solaris packages.

Your architecture then becomes very similar to Linux + yum or Apt.

share|improve this answer
Thanks for you detailed reply. I will look into the tools that you mentioned. – vs_sa Nov 8 '11 at 15:39

Solaris (at least up to and including 10) is a little different to Linux in that it has "patches", wbich aren't the same as "packages". So, to provide some information about what you could do in Solaris:

At a very basic level, you can tell Puppet to do something onlyif an external command succeeds, or unless an external command succeeds.

So thinking of this in terms of Solaris patches, you could write yourself a little module to ensure particular patches are installed. That module would check (eg. by parsing the output of "showrev -p", or perhaps grovelling around in /var/sadm if you're confident) that the patch isn't already applied, before applying it.

share|improve this answer
IMO, it is easier to use pca, instead of writing your own code for patches. – Not Now Nov 14 '11 at 18:32
Nothing in what I suggested precludes using pca to actually do the work. – Cos Nov 14 '11 at 22:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.