Catalog Cadence, issue 1. First published on LinkedIn, 12 November 2026: read it there and subscribe.
A day late, but no less sincerely: thank you to the veterans who have served, and to the families who served with them. Veterans Day was yesterday. I'm glad we set a day aside for it; the people it honors don't only exist on November 11.
I like to ask a question I first put on our services page, because it still works:
Is your Puppet or OpenVox code a well-oiled machine, or a haunted house that everyone's afraid to open?
Most estates I see are neither. They run. Catalogs compile most of the time. Agents check in. Somebody knows where the bodies are buried, and would rather not take a vacation until after the next renewal. The house isn't haunted so much as uninspected.
Tips travel well in this industry. They get comments from people who have lived the same outage. What they don't usually do is start a sales call. A tip is a flashlight. It lights one corner. A conversation about hiring help starts when someone can see the whole floor plan and decide, calmly, what to fix first.
That's what this newsletter is for, and it's what a Healthcheck is for. Starting next Wednesday, and every Wednesday through the end of the year, I'll write about configuration management, automation, and site operations, with OpenVox as the true open-source, community-governed path, and with an honest word about staying on Puppet when that's the right call.
What "healthy" actually looks like
A healthy estate is boring in specific ways.
Classification is boring. Each node gets one role. That role includes profiles. Profiles hold the work: packages, files, services, and the component modules underneath. You can explain how a new web server gets its class — Hiera, an ENC, a fact — in one breath. site.pp is not quietly running the show with a pile of regex node statements that only two people remember.
Data is boring. Hiera 5, with a hierarchy you can draw on a whiteboard. Lookup merge behavior is intentional. Secrets are not sitting in plain YAML. You can run a lookup with --explain on a key and not need a séance.
Code delivery is boring. There is a control repo. There is a Puppetfile with pinned, current modules. r10k, or a Git-to-environment pipeline you own, is how a commit becomes an environment. "We ssh in and git pull" is a story, not a process. CI compiles the catalogs for your top roles and runs lint and unit tests before a human has to care.
The platform is boring. The CA is not also "the compiler that works." Compilers can be pulled from a load balancer. PuppetDB or OpenVoxDB is backed up. Agent versions are not a museum. Failed runs yell; silent nodes are watched, because a node that stops checking in is ruder than a node that fails.
The future is written down. You know whether you are staying on Puppet Enterprise, repairing a community install, or moving to OpenVox — and you know why. If the honest answer is "we're fine where we are," that is a perfectly good answer. I will say it when it's true.
If that list made you wince in three places, you are in crowded company. Size is not the same thing as health. I have seen 50,000-node estates with a cleaner classification story than a 200-node lab, and the other way around.
The smells I keep finding
A few patterns show up often enough that I will just name them:
- Roles and profiles in name only, with most of the logic still in
site.ppor in one giant profile that includes the world. - Hiera 3 leftovers, or a Hiera 5 hierarchy so deep that nobody will add a key without asking in Slack.
- Unpinned or abandoned Forge modules, and in-house modules that have never seen
puppet-lintoropenvox-lint. - Relationships written against a profile that
includes its component classes, so the order you wrote is not the order the catalog has. (We'll spend a whole issue on that.) - A PE Console classifier nobody can export, sitting between you and a move you might otherwise be ready for.
- One compiler that is "the one that works," and two that are souvenirs.
Why the Healthcheck is the starting point
S & S Consulting Group will happily help you migrate, repair an on-prem platform, train a team, or run the estate with you under Configuration Management as a Service. We will not start there if we have not seen the code.
A Puppet & OpenVox Healthcheck is a look-but-don't-touch review. You give us read-only access to the control repo and in-house modules (or a zip export) and a one-page picture of the environment. We review roles and profiles, Hiera 5, the control repo and r10k or Code Manager, modules, tests and CI, and the platform underneath. You get a written report: an executive summary, an environment snapshot, findings ranked High / Medium / Low with evidence, design recommendations with example code, and a prioritized to-do list. Then we walk through it on a readout call.
We do not change anything in your environment. If you want help fixing what we find, that is a separate conversation, and you are free to do it yourselves with the report. The report is yours to keep either way.
The Healthcheck is a fixed price of $1,495. Onsite is available if you'd rather do it in a room with a whiteboard — ask us and we'll work out the details.
After the report, the path splits in ways that should feel obvious:
- You take the to-do list and run with it.
- You bring us back for on-prem work — a migration sprint, production cutover planning, or OpenVox training (User, Journeyman, and Architect).
- You decide you do not want to staff a full-time CM engineer, and we stay in a CMaaS capacity: architecture, module work, patching, code review, and knowledge transfer, as an extension of your team.
Next week I'll give you a freeze-week checklist you can use before Thanksgiving — a terrible week to cut over a compiler, and a pretty good one to inventory, lint, and write down how a change actually reaches a node.
— Jerald Sheets, S & S Consulting Group
---