Gardience · Compare · Updated 2026-11-07 · Gardience Engineering · How we test

Puppet alternative for Windows and Linux fleets

• 25nodes: reported limit before Perforce's Puppet builds need a license
• $15,000a year at 1,000 machines, Windows and Linux
• 20Windows and Linux platforms verified on real machines
• 1,020servers patched in 13 minutes, one approved run

Puppet is a configuration management tool owned by Perforce since 2022: an agent on each machine pulls its configuration from Puppet Server on a schedule and corrects drift. In late 2024 Perforce moved new Puppet builds to a private repository, and the community forked the open-source code as OpenVox. Gardience is a fleet console on open-source Salt, the closest engine to Puppet's model, with patching, compliance, approvals, and evidence built in.

• Patching built in: Windows and Linux, pilot and broad rings, change windows, and second-person approval.
• CVE response: CVEs matched on every machine and ranked by CISA KEV and EPSS, fixed on only the exposed machines.
• DISA STIG checklists: on Windows Server, Windows 10 and 11, RHEL-family, SLES, and Ubuntu, weekly scans and a STIG Viewer checklist per machine for eMASS, plus a STIG/CIS-aligned baseline that is checked and fixed. See STIG automation.
• CMMC Level 2: covers all 110 requirements with a live SPRS score, SSP, POA&M, and a signed evidence pack.
• Drift repair and events: a stopped service is restarted within seconds, with both the drift and the fix on the record.
• A tamper-evident audit log of every change, who asked for it, and who approved it.

• The license changed. Reporting on Perforce's change says production use above 25 nodes needs a commercial license, and NC State noted no new releases in the public repositories as of July 2025.
• Changes wait for the next check-in. A Puppet agent converges on its next run; a Salt job reaches every connected machine in seconds and streams the results back.
• Patching and evidence live elsewhere. Configuration management is one tool; patching, CVE response, and the auditor's report are others. Gardience does all of it from one console.

OpenVox is the shortest step: keep your manifests, modules, and Hiera data, and swap the packages. Moving to Salt is more work and pays off when you want faster changes, first-class Windows, event-driven repair, approvals, and compliance evidence from the same agents. Salt states are declarative YAML, closer to Puppet manifests in spirit than procedural playbooks are. Our guide to open-source Puppet after Perforce walks through all four options.

1. Install Gardience on any supported Linux server, in about five minutes, or fully offline.
2. Enroll machines next to their Puppet agents. Both run side by side; nothing is removed.
3. Patch and prove first. Patching, the security baseline, CVE matching, and STIG scans work on day one, with no states written.
4. Move roles one at a time, starting with the ones you change most: write the Salt state from Git, test it on a pilot group, then stop managing that role in Puppet.
5. Retire Puppet Server when the last role has moved.

Manifests cannot be converted to Salt states reliably by a tool, so plan a staged move rather than a cutover.

Starter is $6,000 a year for up to 250 machines and Team is $15,000 a year for up to 1,000, Windows and Linux alike, with no per-node charge. Enterprise starts at $40,000 for larger or air-gapped fleets. The free 90-day trial covers 25 machines. See pricing.

Not today. Gardience runs Salt states and your existing Ansible playbooks over the Salt connection. Puppet manifests move to Salt states over time, one role at a time.

The source code remains under the Apache 2.0 license, but Perforce's packages come from a private repository, and reporting on the change says use beyond 25 nodes needs a commercial license. Check Perforce's current terms. OpenVox provides community builds.

Yes. The Salt agent and the Puppet agent run side by side, so you can move one role at a time and stop managing it in Puppet once the Salt state is proven.

Yes. The Salt agent runs natively on Windows, and Gardience adds Windows patching, a scored baseline, BitLocker, and approvals on top, in the same console as Linux.

Checked November 7, 2026.

• DevClass on Perforce's Puppet changes and the community fork.
• NC State on the Puppet repository changes.
• The New Stack on OpenVox and Vox Pupuli's OpenVox page.
• Puppet by Perforce, for current terms.

Read more

• Open-source Puppet after Perforce: your options in 2026
• Salt vs Ansible for Windows servers
• Self-healing servers with event-driven automation
• GitOps for Salt: states in Git, the rest in Terraform
• Chef Infra licensing: what is free, what needs a license, and the Cinc option