Is it possible to setup puppet in a way that changes in manifests only will be applied during certain hours, so that any eventual downtime on our server will occur when we decide it to?


2 Answers 2


I just had to solve this problem... There are a few approaches...

  • Use cron. If you have an OS that supports cron.d entries, distribute a puppet.cron file via Puppet. The accompanying manifest would have something that ensures that the Puppet daemon is off. If you have a lot of servers, use a bash function to randomize the cron pull time to reduce the load on the master server. Also see the Puppet wiki on this topic.

The module I use:

class puppet_cron {

   file { '/etc/cron.d/puppet.cron':
     ensure   => file,
     owner    => root,
     group    => root,
     mode     => 644,
     source   => "puppet:///modules/puppet_cron/puppet.cron",

   service { 'puppet':
     ensure    => stopped,
     enable    => false,


An example puppet.cron:

# puppet.cron
# Run puppet in one-time mode during daily downtime window.

# Puppet check window for Monday through Thursday
*/15 16-19 * * 1-5 root exec /usr/sbin/puppetd --no-daemonize -o
  • There's a Puppet schedule metaparameter that allows you to list times when manifests should be evaluated on a per-class basis. See: https://serverfault.com/a/341865/13325

  • I recently read a book that suggested using Git as a manifest distribution method in order to scale and reduce the load on the master server. This means you'd have more granular control over scheduling.

  • You don't need to use a bash function to randomize the time -- that's what the fqdn_rand() Puppet function is for. Mar 17, 2012 at 15:00
  • @ewwhite can link me to the git post?
    – Cherian
    Aug 6, 2012 at 10:54
  • @Cherian The process is described in this article, but also covered in detail in the author's book, The Puppet Cookbook.
    – ewwhite
    Aug 6, 2012 at 12:37

Yes, just setup the cronjob that runs puppet to only run during certain hours. Running puppet as a daemon is a really terrible idea. We use the IP address of the server as the key into a hashing function to splay our cronjobs across the entire time period of our Puppet runs, to avoid a thundering herd problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.