Only one Puppet book from a major publisher covers Puppet 8, and no major publisher has printed a new Chef book since early 2018. That is the honest state of the shelf for Puppet books and Chef books in 2026, and the tools moved underneath it. Perforce stopped publishing open source Puppet packages in early 2025, the community forked them as OpenVox, and Progress now puts a license key on its Chef Infra Client downloads, so you will want Cinc, the free community build.
This list keeps the five books still worth paying for and says how old each one is. You do not need a Puppet 9 book to run OpenVox, because the language is the same and the commands keep their names, but you do need to know which install chapters will send you to a dead repository. We ran the Puppet 8 book’s own example manifests on OpenVox 9.1.0 and a Chef recipe on Cinc Client 19.3.14, both on Rocky Linux 10 in October 2026.
Pick a Puppet or Chef book by the tool you run
Start from the tool already running in your fleet, because a Chef shop gets nothing from a Puppet book and these two tools share no syntax. If you are still choosing a tool, skip to the last pick and read our Ansible vs Chef vs Puppet vs Salt comparison before you buy anything:
- Best Puppet book: Puppet 8 for DevOps Engineers
- Best for Puppet code design: Puppet Best Practices
- Best first Chef book: Learning Chef
- Best Chef recipe reference: Chef Cookbook, Third Edition
- Best if you’re choosing a tool: Infrastructure as Code, 3rd Edition
A Puppet team should own the first two, because one teaches the platform and the other teaches how to keep a large codebase from rotting. A Chef team gets less help: both Chef picks predate Chef Infra Client 19 by years, so you will read them next to the current Chef docs. Many new projects pick Ansible instead, and in that case our Ansible books list is the better place to spend money.
Know what changed under Puppet and Chef
Every book below tells you to install packages from yum.puppet.com or downloads.chef.io, and both of those stopped being the default free path. Perforce moved new Puppet builds to a private repository in early 2025, free for development use up to 25 nodes under a EULA, with a commercial license past that. Vox Pupuli shipped the first OpenVox release in January 2025 and OpenVox 9 on October 2, 2026. Chef went the same way earlier: Chef Software announced in April 2019 that its binaries would ship under a proprietary license, the Cinc project started shipping Apache 2.0 builds in response, and Progress bought Chef in 2020. This is where each one stands now:
| Tool | Who ships the packages | License on the packages | Current line (Oct 2026) |
|---|---|---|---|
| Puppet Core | Perforce, private repository | EULA, free to 25 nodes for development | Puppet 8; last public open source build 8.10.0 (October 2024), no EL10 release package |
| OpenVox | Vox Pupuli, yum.voxpupuli.org and apt.voxpupuli.org | Apache 2.0 | openvox-agent 9.1.0 and 8.31.0, OpenVox 8 gets security fixes for at least six months |
| Chef Infra Client | Progress Chef | Chef EULA; license key needed for downloads | Chef 19, the LTS line, packaged with Habitat |
| Cinc Client | Cinc project on OSU Open Source Lab | Apache 2.0, no EULA | 19.3.14 (May 2026) |
Forks are what keep these books usable. OpenVox still installs the puppet command under /opt/puppetlabs/bin, and Cinc symlinks chef-client and chef-solo to its own wrapper, so the command names in every chapter still resolve. OpenVox 9 is still a major release with breaking changes, and three of them can trip a book’s examples:
- no fallback to a server named
puppetwhenserveris unset --configprintremoved, usepuppet config printreportsnow defaults tononeinstead ofstore
The OpenVox 9.0.0 release notes list the rest. Set server in puppet.conf and swap the repository in the install chapter, and most of what the books teach holds. We tested some of it at the end of this guide.
How we picked these books
We pulled the full Puppet and Chef shelves for Packt, O’Reilly, Apress and Manning from Amazon’s catalog, out-of-stock titles included, instead of trusting a best-seller page. That census is where the dates in the intro come from. The newest Chef title from any of those publishers is Packt’s Implementing Chef from January 2018, and it is out of stock. The newest Puppet title is Puppet 8 for DevOps Engineers from June 2023. Nobody has published a book on OpenVox or Cinc yet. Manning never finished one: it cancelled its Chef in Action early-access title and has no Puppet book.
Each pick is a print edition Amazon sold and shipped itself when we checked, and each cover matches the exact edition linked. We left out self-published 2024 and 2025 titles with no publisher behind them, and these older books that are still listed but have been overtaken:
- Learning Puppet 4 (O’Reilly, 2016), only from third-party sellers
- Pro Puppet, Second Edition (Apress, 2013)
- Puppet 5 Beginner’s Guide (Packt, 2017)
- Mastering Puppet 5 (Packt, 2018)
- Customizing Chef (O’Reilly, 2014)
Where a publisher shares the book’s code, as Packt does on GitHub, we ran some of it: the chapter 3 examples from Puppet 8 for DevOps Engineers, on OpenVox 9. Where it doesn’t, the contents come from the publisher’s description and table of contents, and we say so. We did not read every chapter of every book.
Compare the 5 Puppet and Chef books
The “Written for” column is the release line the book was current with when it went to press. That is the version its install steps and screenshots will match, and the reason to read every install chapter with the table above open:
| Book | Publisher, year | Pages | Written for | Level |
|---|---|---|---|---|
| Puppet 8 for DevOps Engineers | Packt, 2023 | 416 | Puppet 7 and 8, Bolt, PDK | Beginner to advanced |
| Puppet Best Practices | O’Reilly, 2018 | 305 | Puppet 5, released as Puppet 6 shipped | Intermediate |
| Learning Chef | O’Reilly, 2014 | 366 | Chef 12 era, ChefDK | Beginner |
| Chef Cookbook, Third Edition | Packt, 2017 | 268 | Chef 12, two months before Chef 13 | Intermediate |
| Infrastructure as Code, 3rd Edition | O’Reilly, 2025 | 434 | No single tool | Intermediate |
Only one of the four tool-specific books was written in this decade. That is not a reason to skip the older three, because Puppet’s language and Chef’s resource model changed far less than their packaging did. It is a reason to treat their install chapters as history.
1. Puppet 8 for DevOps Engineers
David Sandilands, who was leading Puppet’s community and developer relations work at Perforce in 2024, wrote the only current Puppet book from a major publisher, and it is the one to buy if you run Puppet or OpenVox today. It covers the language from resources and classes through data types, facts and templating, then Hiera, the platform pieces such as Puppet server and PuppetDB, Bolt for orchestration, and a closing overview of Puppet Enterprise.
Packt’s code repository lists Puppet 7 or 8, Bolt, the PDK, VS Code and an Azure account as the lab kit, and the chapter folders run from ch02 to ch14. We applied the chapter 3 user manifest on OpenVox 9 without changing a line, and it created the group and three users as written. It also uses a resources purge in noop mode, and on our box that flagged our own login account for removal. That is exactly why the book sets noop, and a good lesson to learn on a lab VM.
Two parts have aged. The chapter 2 install script adds yum.puppet.com/puppet7-release and a Puppet Enterprise client tools RPM, and that open source repository has had no new build since October 2024 and no EL10 package. Use the OpenVox repository shown at the end of this guide instead. The Bolt and Enterprise chapters also assume Perforce tooling, so on OpenVox you’d use Vox Pupuli’s OpenBolt and skip the PEADM material.
Pass on it if your fleet is Chef, or if you only need a quick agent install, which our guide to install Puppet on Rocky Linux and AlmaLinux covers. It sold for about $45 to $50 when we checked. Check the current price on Amazon.
2. Puppet Best Practices
Chris Barbour and Jo Rhett wrote the book you read after a year of Puppet, when the codebase starts to hurt. It does not teach the language. It teaches how to lay out modules, keep data in Hiera instead of in manifests, split code into roles and profiles, classify nodes and deploy environments with r10k, which is a structure many large Puppet estates still use.
The roles and profiles chapter alone is worth the price, because that pattern decides whether a 500-node Puppet codebase stays readable. The book came out in autumn 2018, as Puppet 6 shipped, so it predates the deprecations in Puppet 7 and 8 and says nothing about OpenVox. None of that touches the design advice, which applies to OpenVox unchanged.
It is the wrong first book: it assumes you already write manifests. Amazon had it at about $20, well under its $49.99 list price, but Amazon had only a copy or two left when we checked, so the price may move. Check the current price on Amazon.
3. Learning Chef
Mischa Taylor and Seth Vargo’s O’Reilly guide is still the clearest introduction to how Chef thinks, even at more than ten years old. It walks through resources, recipes and cookbooks, then roles and environments, and it teaches testing with Test Kitchen and dependency management with Berkshelf. Those ideas carry straight into Chef 19 and Cinc.
The tooling is where it shows its age. The book sets you up with the Chef Development Kit, which reached end of life on December 31, 2020 and was replaced by Chef Workstation, so install Workstation (or Cinc Workstation) wherever the book says ChefDK. Expect some command output and options to differ from what’s printed, and check the current Chef docs whenever a step fails.
Leave it on the shelf if you want current tooling explained, because neither Chef book here covers Chef Workstation or Chef 19’s Habitat packaging. It was about $17 when we checked, with only a copy or two left at Amazon. Check the current price on Amazon.
4. Chef Cookbook, Third Edition
Matthias Marschall’s Packt cookbook is a set of task recipes rather than a course, so it suits someone who already knows the basics and needs a working example for a specific job. Packt lists testing cookbooks with Test Kitchen and InSpec, managing dependencies with Berkshelf, reporting on chef-client runs, writing custom Ohai and Knife plugins, and building high-availability services with Heartbeat and HAProxy, plus an introduction to Habitat.
It came out in February 2017, two months before Chef 13, so its recipes are Chef 12 code. Basic resources such as package, service and file still behave the same, and a recipe built from them converged cleanly on Cinc 19 in our lab. The Knife plugins and Chef Server workflows are the parts most likely to need adjusting, so check them against our guide to configure Knife and upload cookbooks before you copy them into a pipeline.
Beginners should start with Learning Chef instead, because this book explains little before each recipe. It was about $50 with no discount when we checked. Check the current price on Amazon.
5. Infrastructure as Code, 3rd Edition
Kief Morris does not teach Puppet or Chef syntax, and that is the point of putting his book here. If you’re deciding whether to keep a Puppet or Chef estate, rebuild it on Ansible or move server state into images and Terraform, this is the book that frames the decision. The 2025 edition covers declarative versus procedural infrastructure languages, how to structure and test infrastructure code, platform patterns from servers to serverless, and operating models for governance and cost.
It is the newest book on this list and the one least likely to date, because it argues about patterns instead of commands. Pair it with our roundup of infrastructure as code tools when you get to the shortlist, and with our Terraform books if provisioning is the bigger half of your work.
You will not write a single manifest or recipe from it, so it can’t replace the first four picks. Amazon listed it between about $55 and its $79.99 list price. Check the current price on Amazon.
Check these before buying any Puppet or Chef book
Most of what goes wrong with an old configuration management book is predictable, so check these five things on any title, including ones not on this list:
- the release line its code pins, not the year on the cover
- which repository the install chapter adds
- how much depends on Puppet Enterprise or Chef Automate
- ChefDK or Workstation in the setup chapter
- whether the publisher shares the code
Those first two decide how much you’ll rewrite, and the third decides how much of the book applies at all if you run OpenVox or Cinc. A book with public code is worth more than its page count suggests, because you can run its labs on a scratch VM before trusting a chapter. If the answer to most of these is bad and you’re not maintaining an existing fleet, spend the money on learning Ansible playbooks instead.
Run the book examples on OpenVox and Cinc
The fastest way to follow either Puppet book in 2026 is a lab VM with OpenVox, because the commands and paths match the book. On Rocky Linux 10, add the OpenVox 9 repository and install the agent:
sudo rpm -Uvh https://yum.voxpupuli.org/openvox9-release-el-10.noarch.rpm
sudo dnf -y install openvox-agentThe binary keeps Puppet’s name and location, which is why the book’s commands work unchanged:
/opt/puppetlabs/bin/puppet --versionIt reports the OpenVox release:
9.1.0Fetch the chapter 3 user manifest straight from the book’s repository and apply it:
curl -fsSLO https://raw.githubusercontent.com/PacktPublishing/Puppet-8-for-DevOps-Engineers/main/ch03/linux_users.pp
sudo /opt/puppetlabs/bin/puppet apply --color=false linux_users.ppThe users and group were created, and the noop purge reported our login user without removing it:
Notice: Compiled catalog for cm02.example.com in environment production in 0.02 seconds
Notice: /Stage[main]/Main/Group[exampleapp]/ensure: created
Notice: /Stage[main]/Main/User[exampleappdev]/ensure: created
Notice: /Stage[main]/Main/User[exampleapptest]/ensure: created
Notice: /Stage[main]/Main/User[exampleappprod]/ensure: created
Notice: /Stage[main]/Main/User[josphat]/ensure: removed (noop)
Notice: /Stage[main]/Main/User[josphat]/uid: audit change: newly-recorded value 1000
Notice: Applied catalog in 0.38 secondsThe sudoers example in the same chapter needs fixing before it goes anywhere near production, and it shows why a book’s code belongs on a snapshot VM first. The repository’s answer file, ch03/file_unix_answer.pp, manages /etc/sudoers.d/mongodb. Save that resource as its own manifest so you can test it alone:
vim book_mongodb.ppThis is the resource as the repository has it. The character between su and mongo in the original is an en dash (U+2013); this site’s code blocks can’t carry that character, so it appears here as <U+2013>:
file { '/etc/sudoers.d/mongodb':
ensure => 'file',
content => 'robin All=(ALL) NOPASSWD: su <U+2013> mongo',
validate_cmd => '/sbin/visudo -c',
owner => 'root',
group => 'root',
mode => '0660'
}That single sudoers line has three faults, and any one of them is enough to make it useless:
suwithout a full path, a hard parse error in sudoersAllinstead ofALL, read as a hostname that never matches- an en dash where
suexpects the hyphen ofsu - mongo
Apply it on the snapshot VM:
sudo /opt/puppetlabs/bin/puppet apply --color=false book_mongodb.ppOpenVox refuses the file, and visudo points at the bare su (the en dash is shown as <U+2013> again):
Notice: Compiled catalog for cm02.example.com in environment production in 0.02 seconds
Error: Execution of '/sbin/visudo -c' returned 1: /etc/sudoers.d/mongodb20261019-51386-1p81ypa:1:27: expected a fully-qualified path name
robin All=(ALL) NOPASSWD: su <U+2013> mongo
^~
Error: /Stage[main]/Main/File[/etc/sudoers.d/mongodb]/ensure: change from 'absent' to 'file' failed: Execution of '/sbin/visudo -c' returned 1: /etc/sudoers.d/mongodb20261019-51386-1p81ypa:1:27: expected a fully-qualified path name
robin All=(ALL) NOPASSWD: su <U+2013> mongo
^~
Notice: Applied catalog in 0.03 secondsLook at the file name in that error, because it explains why the check worked at all. Without a % in validate_cmd, Puppet never passes the new content to visudo, so visudo -c only checks the live /etc/sudoers and the files it includes. OpenVox happened to stage the new content beside the target as /etc/sudoers.d/mongodb20261019-..., a name with no dot, so the #includedir in /etc/sudoers pulled it in and the check saw it by accident. The same resource escapes the check when the target is:
/etc/sudoersitself- a file outside the included directory
- a sudoers.d name with a dot, such as
mongodb.conf
We tested the last case: with the target renamed to /etc/sudoers.d/mongodb.conf, the broken line was written without an error, visudo -c still reported every file as parsed OK, and only visudo -cf /etc/sudoers.d/mongodb.conf showed the same parse error. The other two cases follow from how visudo -c and #includedir work in the sudoers manual. The fix is to hand visudo the staged file with %, so the check never depends on where the file lands:
vim fixed_mongodb.ppUse a fully qualified su, the ALL keyword, a plain hyphen, a trailing newline and mode 0440, the same mode as the cloud-init drop-in:
file { '/etc/sudoers.d/mongodb':
ensure => 'file',
content => "robin ALL=(ALL) NOPASSWD: /usr/bin/su - mongo\n",
validate_cmd => '/usr/sbin/visudo -cf %',
owner => 'root',
group => 'root',
mode => '0440',
}Apply it, then check the whole sudoers tree:
sudo /opt/puppetlabs/bin/puppet apply --color=false fixed_mongodb.pp
sudo visudo -cThis time the file is written, and visudo -c lists it as clean:
Notice: Compiled catalog for cm02.example.com in environment production in 0.02 seconds
Notice: /Stage[main]/Main/File[/etc/sudoers.d/mongodb]/ensure: defined content as '{sha256}cb57b676cc23ce086c28f2e56e94296a9065e0c970576c530fb2c098f0330135'
Notice: Applied catalog in 0.03 seconds
/etc/sudoers: parsed OK
/etc/sudoers.d/90-cloud-init-users: parsed OK
/etc/sudoers.d/mongodb: parsed OKDon’t copy the first resource in that answer file at all on a cloud VM. It sets /etc/sudoers.d to recurse => true and purge => true, which deletes every drop-in Puppet doesn’t manage, including 90-cloud-init-users, the file that gives the cloud login user sudo. Put it in its own manifest:
vim book_sudoers_dir.ppCopy the directory resource exactly as the answer file has it:
file { '/etc/sudoers.d':
ensure => 'directory',
recurse => true,
purge => true,
}Apply it with --noop only, so nothing is deleted:
sudo /opt/puppetlabs/bin/puppet apply --color=false --noop book_sudoers_dir.ppThe noop run names the cloud-init drop-in:
Notice: Compiled catalog for cm02.example.com in environment production in 0.01 seconds
Notice: /Stage[main]/Main/File[/etc/sudoers.d/90-cloud-init-users]/ensure: removed (noop)
Notice: /etc/sudoers.d: Would have triggered 'refresh' from 1 event
Notice: Class[Main]: Would have triggered 'refresh' from 1 event
Notice: Stage[main]: Would have triggered 'refresh' from 1 event
Notice: Applied catalog in 0.04 secondsRun that for real over SSH and your login user loses sudo on the box, with no way back except the console or a snapshot. Manage the cloud-init drop-in as a Puppet resource before you turn on a directory purge, and always validate sudoers content with visudo -cf %.
For the Chef books, Cinc’s installer takes the major version and needs no license key:
curl -fsSL https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -v 19Then write a small recipe with the core resources both Chef books lean on:
vim base.rbIt installs chrony, starts the service and writes a message of the day:
package 'chrony'
service 'chronyd' do
action [:enable, :start]
end
file '/etc/motd' do
content "Managed by Cinc Client\n"
mode '0644'
endRun it with cinc-apply. Cinc’s packages are Apache 2.0 with no EULA, but the --chef-license option comes along from the upstream Chef code that Cinc is rebuilt from, so we passed accept-silent the way the Chef docs show it:
sudo cinc-apply base.rb --chef-license accept-silentChrony was already present on the Rocky image, so only the file resource changed, and Cinc restored the SELinux context on /etc/motd by itself:
Recipe: (cinc-apply cookbook)::(cinc-apply recipe)
* dnf_package[chrony] action install (up to date)
* service[chronyd] action enable (up to date)
* service[chronyd] action start (up to date)
* file[/etc/motd] action create
- update content in file /etc/motd from e3b0c4 to 572ecc
--- /etc/motd 2023-11-29 10:34:49.000000000 +0000
+++ /etc/.chef-motd20261019-51582-3e9kye 2026-10-19 15:33:11.237165408 +0000
@@ -0,0 +1 @@
+Managed by Cinc Client
- restore selinux security contextTyping sudo chef-client --version prints “Redirecting to cinc-client” and then Cinc Client: 19.3.14, so the chef-client command names in Learning Chef and the Cookbook still resolve. With the two forks in place, the language in these books still works, and the install chapters are the part you rewrite first. For a full Chef server rather than a single node, our Chef Infra Server setup guide still applies, but plan past it: Progress ends open source Chef Infra Server in November 2026 in favor of Chef 360, and the Cinc project is forking Cinc Server to keep it going. For a Puppet server on Debian, use the Puppet Server 8 install on Debian.
