Until recently, I was under the impression that merely declaring a resource with various attributes would ensure that Puppet manages the resource and brings it back to the configured state if it were to change.

Today, I found that wasn't the case for a yumrepo resource I have configured, until I added an audit => all metaparameter to the resource. I deleted /etc/yum.repos.d/foo.repo and ran puppetd --test. Puppet did not recreate the resource. Does that indicate a Puppet defect?

If that's the intended behavior, it begs the question, what other resources require audit => all to tell Puppet to manage the resource's state if it changes on the system under management?

Here is the repository class:

class yum::therepo {
    # Temporarily remove the Yum repo configuration if we don't have
    # httpd yet.
    exec { 'disable-the-repo-to-get-its-dependencies':
        provider => shell,
        command => 'rm -f /etc/yum.repos.d/the.repo',
        unless => 'rpm -q httpd',
        onlyif => 'test -f /etc/yum.repos.d/the.repo',
        before => [Package['httpd'], Exec['httpd-for-yum'],],
        path => '/bin:/usr/bin',

    # Ensures httpd is running as a Yum server before anything else
    # tries to install packages from it.
    exec { 'httpd-for-yum':
        provider => shell,
        command => '/sbin/service nginx stop || true ; /sbin/service httpd restart',
        require => Class['yum::server'],

    yumrepo {
            require    => [Exec['httpd-for-yum'],],
            descr      => "The YUM Repo",
            baseurl    => "http://yum/repos/redhat/5/x86_64/",
            gpgcheck   => "0",
            enabled    => "1",

            # One puppet run failed to recreate the.repo. I added audit
            # => all, and the next puppet run did recreate the.repo.
            # Possibly a red herring. I'd like to understand why it
            # worked in one case and not in the other.
            #audit      => all,

And the Yum server class:

class yum::server {
    include httpd
    include iptables

    package { ['createrepo']:
        ensure => present;

    exec { 'update-repo-metadata':
        require => [ Package['createrepo']],
        cwd => '/var/www/html/yum',
        command => '/usr/bin/createrepo --update -d repos/redhat/5/x86_64/',
        creates => '/var/www/html/yum/repos/redhat/5/x86_64/repodata/repomd.xml',

    file {'/etc/httpd/conf.d/yum.conf':
        ensure  => file,
        mode    => 0644,
        source  => "puppet:///modules/yum/yum_httpd.conf",
        require => Package['httpd'],
        notify  => Service['httpd'],
  • Could you post the resource definition ? – golja Sep 21 '12 at 5:14
  • Added the resource definitions. – Matt McClure Sep 21 '12 at 16:44
  • I ran into the same problem - turns out that you don't need the audit parameter to recreate the repos. Rather, you have to restart puppet to get it to recreate it. Not very nice. :| – Rilindo Oct 1 '12 at 20:48

I think you're misunderstanding the audit flag, but could you post your yum resource section, as that'd help alot. Typically, no, you don't need audit on a yumrepo resource to make it create a .repo file.


  • Thanks for replying. I added the resource definitions to the question. – Matt McClure Sep 21 '12 at 16:44

Creating most Puppet resource types without an ensure property is undefined behavior. Sure, Puppet knows about the resource, but without knowing what the end-state is supposed to be, Puppet can't do anything useful with it.

As an example, try to puppet apply the following code fragment:

file { '/testfile': }
  • The ensure parameter is not a metaparameter applicable to all resource types. In particular, the yumrepo resource type has no ensure parameter. – Matt McClure Sep 29 '12 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.