I want to make sure user bob is in wheel group on every server managed by puppet, but I do not want to change any other group membership for that user if on one node bob belongs to the apache group, and on another he is in sftpusers. I want to leave him in any group he belongs to, and additionally ensure he is in wheel.

What is the proper solution? It cannot be to exec => usermod or something tacky like that. There must be something better I imagine.


If you're already having Puppet manage this user, you can just use the 'groups' attribute to determine what groups a user is in. If the user is in groups that aren't managed by puppet, you'd want to set membership to 'minimum', which would just ensure the user is in the specified groups (it wouldn't overwrite any existing groups).

For example:

user { "someuser":
    groups     => [ 'wheel', 'othergroup' ],
    membership => 'minimum',

This is explained a bit more in the type reference.

| improve this answer | |
  • Can you elaborate a bit more on what this means? – ewwhite Mar 16 '14 at 22:55
  • 'Minimum' is the default, so you don't have to state it explicitly. – sciurus Mar 16 '14 at 23:27
  • Right, but IMO it makes it easier to understand. It doesn't hurt anything to specify, so why not? – devicenull Mar 17 '14 at 4:15
  • So any attribute/value pairs of a resource that aren't mentioned in the resource simply aren't managed by Puppet, and are not overwritten by Puppet? – usedTobeaMember Mar 17 '14 at 16:12
  • It depends on the resource. You'd have to check the type reference to be sure. – devicenull Mar 17 '14 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.