Originally announced at Puppetize PDX, Portland, Oregon, October 9, 2019. Source: Puppet press release via GlobeNewswire / covingtonjournal.com.
Overview
At its annual user conference, Puppetize PDX, Puppet announced a set of product updates and a new public beta aimed at helping engineering teams tackle three persistent DevOps challenges: deploying cloud-native applications continuously, enforcing compliance across distributed infrastructure, and remediating security vulnerabilities faster. The three pillars of the announcement were Project Nebula, Puppet Enterprise 2019.2, and Puppet Remediate.
“With cloud-native architectures on the rise and infrastructure environments becoming more distributed and heterogeneous, ensuring they can scale in a secure, auditable, and efficient manner becomes more challenging. That’s why Puppet is focused on building solutions and contributing to open source projects that focus on making it easier to automate your infrastructure and remove complexities in the way that best suits your needs; agent, agentless, declarative, and task-based.”
— Yvonne Wassenaar, CEO, Puppet (October 2019)
Project Nebula: Continuous Deployment for Cloud-Native and Serverless Workloads
One of the most significant announcements at Puppetize PDX was the public beta launch of Project Nebula, Puppet’s answer to a growing pain point in cloud-native adoption: stitching together heterogeneous tools — Kubernetes operators, serverless frameworks, CI pipelines, and cloud provider CLIs — into a coherent, repeatable end-to-end deployment workflow.
As organizations scale cloud-native adoption across multiple teams, the lack of a standardized deployment workflow creates inconsistency, manual toil, and risk. Project Nebula aimed to give software delivery teams a single, easy-to-use interface for deploying cloud-native and serverless applications safely and continuously, regardless of the underlying toolchain.
Key Goals of Project Nebula
- Unified deployment workflow: Compose heterogeneous cloud-native tools into a single pipeline without custom glue code.
- Multi-team scalability: Provide consistent guardrails so multiple teams can deploy independently without stepping on each other.
- Safety and security: Enforce policy and approval gates within the deployment process itself.
- Cloud-native and serverless support: Target modern workloads running on Kubernetes and Function-as-a-Service platforms.
Project Nebula was released as a public beta at the time of this announcement, meaning production use was not yet recommended but community feedback was actively being solicited.
Puppet Enterprise 2019.2: Extensible Automation and Continuous Compliance
Previewed at Puppetize PDX and slated for general availability in early November 2019, Puppet Enterprise 2019.2 focused on two themes: expanding the breadth of automation use cases and strengthening continuous compliance capabilities for large, distributed infrastructure teams.
Impact Analysis: Safer Compliance Change Management
A standout feature in this release was an enhanced version of Impact Analysis. As infrastructure-as-code deployments grow in scope, it becomes increasingly difficult to predict what a code change will affect before it rolls out to production. Impact Analysis addresses this by performing a pre-deployment assessment that identifies which servers, configurations, and services would be affected by a given change.
The 2019.2 iteration of Impact Analysis added support for Hiera, Puppet’s hierarchical data lookup system. This is meaningful because Hiera is commonly used to separate configuration data from Puppet code, enabling reuse across environments. With Hiera support, Impact Analysis can now account for data-driven configuration differences when predicting blast radius — a notable improvement for teams managing complex, multi-environment deployments.
What Continuous Compliance Means in Practice
Continuous compliance in the Puppet context means that infrastructure state is continuously evaluated against defined policy baselines — regulatory (such as PCI-DSS or CIS benchmarks), security, or operational — and drift is detected and corrected automatically or flagged for review. Puppet Enterprise 2019.2 extended this capability to support more teams operating within the same infrastructure estate, reducing the risk that compliance enforcement becomes a bottleneck owned by a single central team.
Puppet Remediate: Faster Vulnerability Remediation
First announced in late August 2019, Puppet Remediate is a product purpose-built for vulnerability management workflows. Its goal is to close the gap between vulnerability discovery (typically surfaced by a scanner such as Tenable or Qualys) and the actual remediation of the underlying package or configuration flaw.
According to Puppet’s State of DevOps report cited in the announcement, only 7% of surveyed organizations could remediate vulnerabilities in under one hour. The typical workflow — scanner finds a CVE, a ticket is opened, an operations team manually patches systems — introduces days or weeks of exposure window. Puppet Remediate was designed to compress that window by connecting vulnerability scan data directly to Puppet’s automation engine, allowing teams to prioritize critical vulnerabilities and trigger remediation tasks at scale.
Core Capabilities of Puppet Remediate
- Vulnerability discovery integration: Ingest data from vulnerability scanners to identify affected nodes.
- Risk-based prioritization: Surface the most critical vulnerabilities to act on first.
- Automated remediation tasks: Trigger package updates or configuration fixes across fleets of nodes using Puppet Tasks.
- Audit trail: Record what was remediated, when, and by whom for compliance reporting.
Broader Context: Why These Updates Matter for DevOps Teams
Taken together, these three announcements reflect the direction Puppet was taking in late 2019: moving beyond pure configuration management toward a broader automation platform that spans the software delivery lifecycle. Key themes visible across all three products include:
- Multi-cloud and hybrid support: All three products were designed to work across heterogeneous environments — on-premises, public cloud, containerized, and serverless.
- Self-service at scale: Enabling multiple teams to operate independently without sacrificing governance or consistency.
- Shift-left for compliance and security: Embedding compliance checks and vulnerability remediation earlier and more continuously in the delivery pipeline, rather than treating them as periodic audits.
- Agentless and agent-based flexibility: Supporting both traditional Puppet agent deployments and agentless approaches via Puppet Bolt and Tasks, acknowledging that not every node in a modern estate will run a persistent agent.
About Puppet
At the time of this announcement, Puppet reported more than 40,000 companies using its open source and commercial products, including more than 75% of the Fortune 100. The company was headquartered in Portland, Oregon, with over 500 employees globally. Puppet’s platform supports automation across Linux, Windows, cloud-native, and containerized environments.
Note: Project Nebula was subsequently rebranded. Readers researching current Puppet products should consult Puppet’s official documentation for the latest product names and availability.