Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Puppet supports the concept of resource dependencies where one resource will not by synced until another is synced first. For example, the following Puppet fragment will create the user user1 and the group group1 but it will create the group first:

group { 'group1': 
  ensure => present
}

user { 'user1':
  ensure  => present,
  gid     => 'group1',
  require => Group['group1']
}

My question is: how do dependencies work when the ensure parameter is changed from "present" to "absent":

group { 'group1': 
  ensure => absent
}

user { 'user1':
  ensure  => absent,
  gid     => 'group1',
  require => Group['group1']
}

What does Puppet do in a case like this? Does it remove the group first, or the user first? Or perhaps the order is not defined?

In general, how would you ensure that one resource is not present only when some other resource is already not present.

share|improve this question

2 Answers 2

I'm fairly sure it removes the group first.

This sort of situation usually comes up in definitions. What I normally do is something along the lines of:

user { 'user1':
  ensure  => $ensure,
  gid     => 'group1',
  require => $ensure ? {
    present => Group['group1'],
    absent  => undef,
  }
}

It's ugly but it works. There may be a better way.

Also, I believe it doesn't actually matter if Puppet removes the group first in this sort of case, so you could just leave the dependencies alone and not worry about it. The user will be in a non-existent group for as long as they still exist, which won't be long. Probably not much harm done.

share|improve this answer
    
How does this ensure that the user is deleted before the group? –  user35042 Apr 5 '13 at 17:11
1  
It doesn't -- you would need to do the similar transformation for the group as well. Or use the solution in the other answer of setting the dependency conditionally, which is equivalent but doesn't require changing the group definition. –  rra Apr 5 '13 at 20:21

You can remove "require => Group['group1']" from the user resource and the resources will still be created properly. You can then use a conditional to change the relationship between User and Group when trying to "ensure => absent".

$ensure = 'absent'

if $ensure == 'absent' {
    User[user1] -> Group[group1]
}

group { 'group1':
    ensure => $ensure
}

user { 'user1':
    ensure  => $ensure,
    gid     => 'group1',
}

Here is an existing bug report:

http://projects.puppetlabs.com/issues/9622

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.