When you're decomissioning a machine that has been managed by Puppet you may want to programatically clean up the node. There are two parts to this:
- revoking and deleting the certificate of the node in Puppet's CA
- deactivating the node in PuppetDB
The following should work for Puppet 4.x and Puppet DB 4.x (including Puppet Enterprise 2016.4.x, 2017.1.x, 2017.2.x).
I've used certificate based auth, and the examples are being run from the puppet master so make use of existing certificates for authentication. When run remotely the cacert, certificate and corresponding private key for authentication will need to be present.