In some cases, we need to test a configuration in a server that is managed by Puppet. Besides excluding the server in the manifest file, there are two more ways to do it:
1) Use “chattr +i <file>” to set the file to immunable to prevent even root from changing the file. Use “chattr -i” to remove immunalbe flag.
2) Use “puppet agent –disable” to put a lock in place. puppet agent won’t work until the lock file is removed. Use “puppet agent –enable” to remove the lock.
Jackie Chen's IT Workshop 