Optional: enforce the old harvest state (--enforce)
-
If drift exists and ansible-playbook is on PATH, Enroll can generate a manifest from the old harvest and apply it locally to restore expected state. It avoids package downgrades, and will often run Ansible with --tags role_... so only the roles implicated by the drift are applied. This is intentionally Ansible-based today, even when you also use Puppet or Salt rendering for normal manifests.
+
If drift exists and your desired config manager is on $PATH, Enroll can generate a manifest from the old harvest and apply it locally to restore expected state, if you pass the --enforce argument to enroll diff. By default, it will try to use Ansible for that, but you can pass --target [puppet|sops] just like with enroll manifest.