Puppet dependency ordering with ensure absent

Question

Puppet supports the concept of resource dependencies where one resource will not by synced until another is synced first. For example, the following Puppet fragment will create the user user1 and the group group1 but it will create the group first:

group { 'group1': 
  ensure => present
}

user { 'user1':
  ensure  => present,
  gid     => 'group1',
  require => Group['group1']
}

My question is: how do dependencies work when the ensure parameter is changed from "present" to "absent":

group { 'group1': 
  ensure => absent
}

user { 'user1':
  ensure  => absent,
  gid     => 'group1',
  require => Group['group1']
}

What does Puppet do in a case like this? Does it remove the group first, or the user first? Or perhaps the order is not defined?

In general, how would you ensure that one resource is not present only when some other resource is already not present.

colinh · Answer 1 · 2013-04-05T20:15:12.867

You can remove "require => Group['group1']" from the user resource and the resources will still be created properly. You can then use a conditional to change the relationship between User and Group when trying to "ensure => absent".

$ensure = 'absent'

if $ensure == 'absent' {
    User[user1] -> Group[group1]
}

group { 'group1':
    ensure => $ensure
}

user { 'user1':
    ensure  => $ensure,
    gid     => 'group1',
}

Here is an existing bug report:

http://projects.puppetlabs.com/issues/9622

score 1 · Answer 2 · answered Apr 05 '13 at 16:56

1

I'm fairly sure it removes the group first.

This sort of situation usually comes up in definitions. What I normally do is something along the lines of:

user { 'user1':
  ensure  => $ensure,
  gid     => 'group1',
  require => $ensure ? {
    present => Group['group1'],
    absent  => undef,
  }
}

It's ugly but it works. There may be a better way.

Also, I believe it doesn't actually matter if Puppet removes the group first in this sort of case, so you could just leave the dependencies alone and not worry about it. The user will be in a non-existent group for as long as they still exist, which won't be long. Probably not much harm done.

answered Apr 05 '13 at 16:56

rra

630
6
10

How does this ensure that the user is deleted _before_ the group? – user35042 Apr 05 '13 at 17:11
1

It doesn't -- you would need to do the similar transformation for the group as well. Or use the solution in the other answer of setting the dependency conditionally, which is equivalent but doesn't require changing the group definition. – rra Apr 05 '13 at 20:21

Puppet dependency ordering with ensure absent

2 Answers2