Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using ensure => latest, I have systems which do not need all of the same packages.

Will ensure => latest install the packages or only update if they already are present? If they are not present, I do not want them installed. This is to keep existing packages up to date with latest patches. I haven't tried it for fear of installing a package on a system which doesn't need it.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Yes, it will install the package if not present.

You'll only want those resources declared on systems which have the packages - break them out into classes based on system role for those that have the packages installed.

share|improve this answer
    
so in my nodes.pp, add an include for each host and have a module for patches? e.g modules/patches/normal.pp and modules/patches/exceptional.pp , for instance? –  Brian Apr 17 at 17:04
    
@staticx You should have the package resources (with the ensure => latest if desired) in the modules that manage the applications - so for instance, if you have an application service that uses PHP, you'd have the PHP packages' resources in the module for that application service. –  Shane Madden Apr 17 at 17:06
    
In this case, it's patches not just for applications but libraries.. for instance, glibc or nss. I am not managing those, just need to ensure they have the latest security updates. –  Brian Apr 17 at 17:07
1  
@staticx Ahh, I see. Puppet's not very good about being a general patch management platform (at least not with package resources), as you'd be defining hundreds or thousands of package resources to get the equivalent of a yum update. Maybe something that will manage automated updates without package resources will work? github.com/example42/puppet-yum –  Shane Madden Apr 17 at 17:17
1  
@staticx Yup, that would be a good solution. –  Shane Madden Apr 17 at 17:32

Yes, ensure => latest will install it if it's not present on the system.

You shouldn't have that package resource declared on a system which doesn't need it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.