Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have exactly the problem described here 2 years ago and I could not find any documentation about this.

I have to realize a virtual resource twice on the same host, and this does not seem to be possible. Is there a workaround or do I have a design issue ?

The goal is to deploy the same ssh public key for different accounts. I declare the public key as a virtual resource

@ssh_authoized_key{'blah': ....}

And to realize it for the users and for root accounts I do :

Ssh_athorized_key<|tag==admin|>{ user => 'root' }

Only the second of the 2 statements will be realized. I tried to isolate them in different classes, but the problem is still the same.

Does someone have an idea to get me out of this ?


share|improve this question
up vote 1 down vote accepted

Use a define instead.

define create_virtual_ssh_authorized_key($user, $tag) {
    @ssh_authorized_key { "$name":
        user => $user,
        tag  => $tag,

define realize_ssh_authorized_key($tag, $user = undef) {
    if ! defined($user) {
        Ssh_authorized_key <| tag == $tag |>
    } else {
        Ssh_authorized_key <| tag == $tag |> { user => $user }

Then you can do:

create_virtual_ssh_authorized_key { adminonly: user => blah, tag => admin, }
create_virtual_ssh_authorized_key { rootadmin: user => root, tag => admin, }
realize_ssh_authorized_key { adminonly: tag => admin, }
realize_ssh_authorized_key { rootadmin: tag => admin, user => root, }
share|improve this answer
Thank you for this idea. I tried it out. But it does not work, the second 'realize_ssh_key' declaration will not be executed. I think that, in the end, you end up calling for the realization of a resources wich has already been realized. – skizo Mar 22 '13 at 8:57
You want to create two different resources, not to realize a resource twice. For that simply give it another name in the first define ` @ssh_authorized_key { "${name}-${user}":` – jonhattan Aug 22 '14 at 11:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.