Puppet user creation with condition

Question

How to create user with same UID(only if it doesn't exists) without affecting the servers having the same user with random UIDs. To give more insight: 1. Maintain a user, "user1" all across the fleet of servers with same UID 2. A considerable number of servers are having the same user with random UID. The puppet class should do nothing in that case

user { 'user1':
        ensure   => present,
        comment  => 'Appp user',
        uid      => 55555,
        onlyif   => <if the user1 is not present>   ---> I know there is no attribute called onlyif in 'user'
        gid      => 55555,
        home     => '/home/user1',
        shell    => '/bin/bash',
    }

Any help appreciated.

Aaron Copley · Accepted Answer · 2019-05-07T20:45:24.180

In order to do what you describe, you'd need a custom Fact to check for the existence of user1 and do something conditionally based on the state on that system.

Maybe you parameterize UID based on user1 existence. If there's already a user1, don't manage uid.

$user1_uid = $::user1 ? {
  true => undef,
  default => 55555,
}

user { 'user1':
  ensure   => present,
  comment  => 'Appp user',
  uid      => $user1_uid,
  gid      => 55555,
  home     => '/home/user1',
  shell    => '/bin/bash',
}

Or, worse, wrap your user creation in an Exec resource with a shell script.

Both of these are not the best options, but given what you have asked this is what you can do. Personally, I'd look into what it would take to migrate the UID of user1 on the systems where it isn't consistent. That might be more of an up front effort, but should pay off over time.

EDIT:

I ran a scenario based on your comments and verified my concern. Puppet functions are executed by Puppetserver. So, the conditional you wrote is not dependent on the state of user1 on the client, but on the master.

I started by adding user1 to a Puppet client system. Then, I took your code and created a file user1.pp.

$user_id = inline_template("<%= `/usr/bin/getent passwd user1` %>") 
if ("$user_id" == "") {
  user { 'user1': 
    ensure => present,
    comment => 'App user',
    uid => 61234,
    gid => 61234,
    home => '/home/user1',
    shell => '/bin/bash', 
  } 
} else { 
  notify { "The group is already present. Skipping..": } 
}

When I executed this file with puppet apply, I get the expected result when the user already exists because the command inside inline_template() is executed locally. (This is the same result if the user existed on the Puppetserver host.)

[root@localhost ~]# puppet apply /root/user1.pp 
...
Notice: The group is already present. Skipping..
Notice: /Stage[main]/Main/Notify[The group is already present. Skipping..]/message: defined 'message' as 'The group is already present. Skipping..'
Notice: Applied catalog in 0.15 seconds

When I put the code on my Puppetserver and run puppet agent, it tries to modify the existing user. You have described this as an undesired result.

[root@localhost ~]# puppet agent -t
...
Notice: /Stage[main]/User[user1]/uid: uid changed 1000 to 61234
Error: Could not find group(s) 61234
Error: /Stage[main]/User[user1]/gid: change from 1000 to 61234 failed: Could not find group(s) 61234
Notice: /Stage[main]/User[user1]/comment: comment changed '' to 'App user'
...

If the user exists on the Puppetserver but not the client, the user is not added because the getent function returns successfully on the Puppetserver.

[root@localhost ~]# id user1
id: user1: no such user
[root@localhost ~]# puppet agent -t
...
Notice: The group is already present. Skipping..
Notice: /Stage[main]/Notify[The group is already present. Skipping..]/message: defined 'message' as 'The group is already present. Skipping..'
Notice: Applied catalog in 19.73 seconds

I am afraid that you need to reconsider your solution to get your desired results. If you run your solution you may accidentally change UID.

Aaron, Thank for your time and a good explanation. Both the ideas are good. But after few trial and error , I used inline template and a 'if' loop. $user_id = inline_template("<%= `/usr/bin/getent passwd user1` %>") if("$user_id" == "") user { ‘user1’: ensure => present, comment => ‘App user', uid => 61234, gid => 61234, home => '/home/user1’, shell => '/bin/bash', } else { notify { "The group is already present. Skipping..": } } } — Nithya Bee, May 07 '19 at 10:31
The reason we do this, we have many app servers already started without much pre-planning with random IDs. Now we wanna streamline the configs to reduce further conflict, atleast when the app is restarted for some reason, but at the same can't afford to bring down the running apps. — Nithya Bee, May 07 '19 at 10:39
I would have thought with `inline_template()` being a function (executing on the Puppetserver) you would only return the state of user1 on the Puppetserver rather than on the client. Either way, I am glad that it is working for you. I certainly understand how you got in your current predicament -- it happens. :+1: — Aaron Copley, May 07 '19 at 20:10
@NithyaBee I updated my answer so I could include more context and formatting. There is a problem with using `inline_template()`. — Aaron Copley, May 07 '19 at 20:40
Thanks Aaron. I dint think of this. Its valuable for me. Appreciate your help. — Nithya Bee, May 09 '19 at 04:37

Puppet user creation with condition

1 Answers1