# Puppet Enterprise > The Puppet Enterprise configuration manager connects Cloud Management Platform (CMP) to your Puppet Enterprise master so that Puppet node groups are assigned to the servers CMP builds --- Site [llms.txt](/llms.txt) --- CMP installs the Puppet agent on each new server, has its certificate signed, and adds the server to the node groups it was ordered with. The **Puppet Enterprise** tile appears in the Add dialog only where a Puppet Enterprise configuration manager already exists, so this page covers deployments that already run Puppet Enterprise. ## What the integration does - Installs the Puppet agent on a new server and signs its certificate. - Sets the server's node groups during provisioning. - Imports node groups from Puppet Enterprise so they can be offered as applications. - Synchronizes servers and retrieves node facts. - Removes a node from Puppet Enterprise and cleans its certificate when a server is decommissioned. The **Version** setting in the configuration manager determines which built-in actions CMP uses and also changes what the manager offers. With **3.X**, CMP shows the certificate name, adds a **Reports** tab, and allows applications to be installed and uninstalled on servers through Puppet Enterprise. With **2015+**, none of those are offered, and you configure the API and SSH endpoints described below. Anything not built in can be added as an action. See [Customize the built-in actions](#customize-the-built-in-actions). ## Prerequisites - Puppet agents run at least every 30 minutes, so that CMP sees current node data. - Your templates and images do not carry the Puppet agent. CMP installs it on the provisioned servers. - CMP can reach the master on port 8140, plus the API ports when using the 2015+ version: 4433 for the master and console APIs, and 8081 for PuppetDB. - A Puppet Enterprise user for CMP to authenticate as, rather than the console admin account. ## Create a user for CMP in the Puppet Enterprise console 1. Go to **Access Control** > **Users** and add a local user for CMP. 1. Go to **Access Control** > **User Roles** and add a role. 1. Open the new role, select the **Member Users** tab, and add the created user. 1. Select the **Permissions** tab and grant the role what CMP needs: view and edit node groups, sign and revoke certificates, and read node data. Puppet's own documentation covers what each permission type allows. ## Create the configuration manager in CMP 1. Go to **Admin** > **Configuration Managers**, then select **Add**. 1. Select the **Puppet Enterprise** tile. 1. Complete the form: - **Hostname**: the Puppet Enterprise master. CMP checks that it can reach it before saving. - **Version**: **3.X** or **2015+**, as described above. - **Environment**: the Puppet environment for created nodes, defaults to `production`. 1. Select **Create**. CMP submits a certificate signing request to the master. 1. On the master, sign the request on the **Certificate requests** page. 1. Back on the configuration manager's **Overview** tab, select **Fetch signed certificate**. CMP's certificate is appended to the `client_whitelist` of three classification groups, which is what grants it access to Puppet's APIs: PE Certificate Authority, PE Console, and PE PuppetDB. ### Endpoints, for the 2015+ version A 2015+ configuration manager lists its connection endpoints on the **Overview** tab, each with a pencil icon to edit it. Both the **PE Master SSH Connection** and the **PE Master API Connection** are required, and the manager will not work until they are configured. **PE Console API Connection** and **PE DB API Connection** are only needed for a split installation, where the console or database runs on a different host from the master. Left empty, each falls back to the master API connection. ### Import node groups On the **Groups** tab, select **Import Groups** to bring in node groups from Puppet Enterprise and pair them with CMP applications. Until that is done, Puppet groups cannot be assigned to servers. The **Nodes** tab lists what CMP knows about each node and includes a **Sync servers** button that refreshes Puppet information for the servers in this manager's environments. ## Customize the built-in actions Most of what this configuration manager does is handled by actions you can read and modify, enabling you to add custom behavior. Each action is named `puppet_ent__`, so the agent bootstrap action for version 3.X is `puppet_ent_3.X_auto_install_agent`. The name uses the stored version value rather than the label, so the **2015+** actions are named `puppet_ent_2015.3_` and then the feature. CMP picks the action whose version matches the one set on the configuration manager for the following features: - `auto_install_agent`: installs the agent during provisioning. - `discover_groups`: lists the node groups available to import. - `get_node_facts`: reads a server's facts during synchronization. - `delete_server_from_connector`: removes the node at decommission time. - `clean_cert`: removes the node's certificate from the master. To support another Puppet Enterprise version, copy the actions from the closest version, rename them for the new version, and add that version to the choices in the configuration manager. A feature with no matching action for the selected version fails when CMP tries to use it. ## Related - [Puppet Open Source](/docs/cmp/configure/integrations/configuration-managers/puppet-open-source/): Connecting to an open-source Puppet master. - [Orchestration actions](/docs/cmp/use/orchestration/actions/orchestration-actions/): Viewing and editing the actions behind this integration.