Puppet alternatives in short

Puppet users have four realistic routes after the 2026 licence change: stay on Perforce's Puppet, move to OpenVox, the community fork, move to Ansible, or move to another tool such as Chef or Salt. Staying and OpenVox keep your code. Ansible and the others mean a rewrite. Pick by what your agreement with Perforce says, how much code you have, and how sure you are that your modules work on the fork. As of 4 November 2026, no vendor end-of-life date for Puppet 8 or 9 falls before 2028.

If you run Puppet today and want engineers on call for the servers or a written test of OpenVox against your own modules, see our Puppet support, upgrades and OpenVox migration page. This post covers the choice itself.

Three dated facts frame the decision, all from Perforce's own Puppet Core release notes. Open source Puppet 7 and Puppet Core 7 reached end of life in April 2025. As of August 2026, Perforce develops and supports Puppet Core versions 8 and 9 as a proprietary product. The latest release on that page was Puppet 9.1.3. What "proprietary" means for the binaries you download is set by the terms Perforce gives you, so read them or ask Perforce. We do not give licensing advice.

Perforce's support lifecycle page gives the dates that follow. Puppet Core 8 reaches end of life in February 2028. Puppet Core 9 reaches it in February 2029, though Perforce marks the Core 9 dates as projected and says it will confirm them when Puppet Enterprise 2026.0 ships. Puppet Enterprise 2023.8.z, the last of the old long-term series, reaches end of maintenance and support on 27 February 2027. From Puppet Enterprise 2026.0, Perforce moves to a "Latest and Latest-1" model, so a series is current for about a year and then in its second year.

The table compares the routes on the points that decide the effort. It is not a ranking.

OpenVox is a community fork of Puppet. Its GitHub releases page shows 9.3.0 and 8.32.0 published on 3 November 2026, each fixing a security advisory rated 9.4 on the CVSS scale, and earlier releases on 29 October and 23 October. The page does not state a licence or which Puppet versions each release tracks, so we treat compatibility as a test result. In practice that means building a staging pool from your control repository, running your modules, agents, Puppet Server and PuppetDB against OpenVox, and reading the failures before any production node moves. AceMQ does not build or ship OpenVox packages.

Ansible is the route most teams mean when they say "leave Puppet", and it is the only one here that is a different model. Puppet agents pull a catalog from a server on a schedule. Ansible pushes tasks from a control node. Every manifest, Hiera lookup and module has to be re-expressed, so the honest measure is your own count of node types and modules. Ansible also has a calendar: ansible-core maintains three versions at a time, with 2.19 reaching end of life in November 2026, 2.20 in May 2027 and 2.21 in November 2027. A rewrite lands you on a different lifecycle, not on no lifecycle.

Chef publishes its terms in its licensing documentation: a licence key is required to download binaries from the Progress download portal, the free tier covers non-production and non-commercial use, and production use needs a commercial licence. Moving from one vendor's licence change to another vendor's licence is a fair thing to price before you rewrite anything. Salt uses a master and minions, and its release notes list 3006 and 3007 releases, with 3008 marked as the upcoming release. We did not review Salt's licence or lifecycle terms for this post, so check the Salt Project's own pages before you shortlist it.

1. Find your versions. List every node by Puppet series. Anything on 7 is already out of vendor support.
2. Read your agreement. Settle with Perforce what applies to the binaries you use. This is the step that decides whether the question is urgent.
3. Count the code. Node types, modules and Hiera depth tell you what a rewrite would cost in your estate.
4. Test OpenVox on a copy. A staging pool built from your real control repository answers compatibility better than any announcement.
5. Decide by ring. Whatever you choose, move a low-risk group first and keep the old servers as the rollback.

AceMQ supports the servers and plans the move, and it does not rewrite manifests or provide Perforce subscriptions. For the wider picture of engagement scope, see our Puppet page and migration services.