---
title: "Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling"
date: "2026-06-30"
description: "Current Enroll 0.7.0 beta notes: the Puppet and Salt experiment has been removed; Enroll now documents Ansible-only output and stronger safety tooling."
summary: "The current beta focuses Enroll back on Ansible-only output, removes stale Puppet/Salt documentation, and clarifies safety and provenance guidance."
html_title: "Enroll 0.7.0 beta - Ansible-only current documentation"
og_title: "Enroll 0.7.0 beta: Ansible-only current documentation"
og_description: "The current Enroll beta removes the old Puppet/Salt experiment from the docs and focuses on Ansible output, validation, SOPS, and safety."
og_type: "article"
---
<header class="py-5 bg-light border-bottom">
  <div class="container">
    <div class="kicker mb-3"><i class="bi bi-megaphone"></i> News</div>
    <h1 class="display-6 fw-bold mb-2">Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling</h1>
    <p class="lead mb-0">The current beta focuses Enroll back on one supported output path: harvest Linux hosts and render Ansible.</p>
  </div>
</header>

<main class="py-5">
  <div class="container">
    <article class="mx-auto" style="max-width: 900px;">
      <p class="text-secondary">Earlier 0.7.0 development builds experimented with Puppet and Salt renderers. That experiment has been removed from the current codebase. The supported flow today is simpler and more honest: harvest a Linux host, validate the bundle, and generate Ansible roles and playbooks.</p>

      <div class="alert alert-info"><strong>Documentation note:</strong> if you find an old command using <code>--target ansible</code>, <code>--target puppet</code>, or <code>--target salt</code>, it is stale. Current <code>enroll manifest</code> has no <code>--target</code> option.</div>

      <h2 class="h3 fw-bold mt-5">What remains</h2>
      <ul class="text-secondary">
        <li><strong>Harvest bundles</strong> with <code>state.json</code> and captured artifacts.</li>
        <li><strong>Ansible manifesting</strong> in single-site mode or <code>--fqdn</code> multi-site mode.</li>
        <li><strong>Role grouping</strong> by package section/group where possible, with <code>--no-common-roles</code> available when you prefer one generated role per package or unit.</li>
        <li><strong>Remote harvesting</strong> over SSH, including OpenSSH config support, sudo prompts, and encrypted key passphrase handling.</li>
        <li><strong>Diff, explain, and validate</strong> workflows for drift reporting and bundle inspection.</li>
        <li><strong>SOPS at-rest encryption</strong> for harvest and manifest bundles.</li>
        <li><strong>JinjaTurtle integration</strong> for supported Ansible templates when the executable is available.</li>
      </ul>

      <h2 class="h3 fw-bold mt-5">A current workflow</h2>
      <div class="codeblock terminal"><button class="btn btn-sm btn-outline-secondary copy-btn" data-copy-target="#news-workflow"><i class="bi bi-clipboard"></i> Copy</button><pre class="mb-0"><code id="news-workflow"><span class="prompt">$</span> enroll harvest --out ./harvest
<span class="prompt">$</span> enroll validate ./harvest
<span class="prompt">$</span> enroll manifest --harvest ./harvest --out ./ansible
<span class="prompt">$</span> cd ./ansible
<span class="prompt">$</span> ansible-galaxy collection install -r requirements.yml
<span class="prompt">$</span> ansible-playbook -i "localhost," -c local playbook.yml --check</code></pre></div>

      <h2 class="h3 fw-bold mt-5">Security and provenance changes</h2>
      <p class="text-secondary">The current documentation is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root <code>PATH</code> foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.</p>
      <blockquote class="blockquote border-start ps-3 text-secondary">This harvest is structurally valid, but Enroll cannot prove it is semantically safe. Only apply manifests generated from harvests whose provenance you trust.</blockquote>

      <h2 class="h3 fw-bold mt-5">Other notable current behavior</h2>
      <ul class="text-secondary">
        <li>Safe-mode content scanning tolerates value-less credential words in comments, but populated credential assignments are still treated as sensitive even if commented out.</li>
        <li>Automatic per-user shell dotfile harvesting is only enabled in <code>--dangerous</code> mode.</li>
        <li>Plain directory harvests are frozen into a private temp tree before manifesting, reducing TOCTOU exposure between validation and rendering.</li>
        <li>Remote harvests reject unknown SSH host keys by default.</li>
        <li>Root runs refuse unsafe non-interactive <code>PATH</code> setups unless <code>--assume-safe-path</code> is supplied.</li>
      </ul>

      <p class="text-secondary mt-5 mb-0">The News and Troubleshooting sections are retained on the website, but they now document the current tool rather than the removed Puppet/Salt experiment.</p>
    </article>
  </div>
</main>