| There are a few different issues filed in this ticket: 1. Can't guarantee the order of user and group deletion. The original issue was filed when puppet did not support manifest ordering. Adding explicit dependencies to ensure resources were deleted in the correct order, didn't work due to PUP-2451. However, Puppet defaults to manifest ordering, so you can easily delete users before groups. 2. USERGROUPS_ENAB=yes/no. If the setting is yes, then ensuring the user and group are absent works correctly (as of 5.5.13) because the group provider determines whether the resource is insync after it's been deleted. So the provider sees that the group doesn't exist and nothing needs to be done:
root@fzt1mvzv8hybr6g:~# cat create.pp |
group { 'foo': |
ensure => 'present', |
} |
user { 'foo': |
ensure => 'present', |
groups => 'foo', |
} |
root@fzt1mvzv8hybr6g:~# puppet apply create.pp |
Notice: Compiled catalog for fzt1mvzv8hybr6g.delivery.puppetlabs.net in environment production in 0.01 seconds |
Notice: /Stage[main]/Main/Group[foo]/ensure: created |
Notice: /Stage[main]/Main/User[foo]/ensure: created |
Notice: Applied catalog in 0.12 seconds |
root@fzt1mvzv8hybr6g:~# cat delete.pp |
user { 'foo': |
ensure => 'absent', |
} |
group { 'foo': |
ensure => 'absent', |
} |
root@fzt1mvzv8hybr6g:~# puppet apply delete.pp |
Notice: Compiled catalog for fzt1mvzv8hybr6g.delivery.puppetlabs.net in environment production in 0.01 seconds |
Notice: /Stage[main]/Main/User[foo]/ensure: removed |
Notice: Applied catalog in 0.10 seconds |
root@fzt1mvzv8hybr6g:~# puppet resource group foo |
group { 'foo': |
ensure => 'absent', |
}
|
3. Discovering users in a group: If the group can't be deleted until all of its users have been deleted, then you first have to know all of the users that need to be deleted. This is what the resources type and purging are intended to solve. However, the resources type does not understand about system groups, so it can try to delete the root, wheel, etc group if you're not careful. 4. Forcing the deletion of groups leaving users with dangling "pointers" seems like the wrong approach as Eric Sorenson and Charlie Sharpsteen have already mentioned. Given the need to purge unmanaged users and groups, I think it would be best to fix the resources type so it doesn't delete system groups, for example, using unless_system_group. Ignoring the issue with system groups, purging does work as expected:
root@fzt1mvzv8hybr6g:~# cat create.pp |
group { 'foo': |
ensure => 'present', |
} |
user { ['foo','bar','baz']: |
ensure => 'present', |
groups => 'foo', |
} |
root@fzt1mvzv8hybr6g:~# puppet apply create.pp |
Notice: Compiled catalog for fzt1mvzv8hybr6g.delivery.puppetlabs.net in environment production in 0.01 seconds |
Notice: /Stage[main]/Main/Group[foo]/ensure: created |
Notice: /Stage[main]/Main/User[foo]/ensure: created |
Notice: /Stage[main]/Main/User[bar]/ensure: created |
Notice: /Stage[main]/Main/User[baz]/ensure: created |
Notice: Applied catalog in 0.23 seconds |
root@fzt1mvzv8hybr6g:~# cat resources.pp |
resources { 'user': |
purge => true, |
unless_system_user => 500, |
} |
resources { 'group': |
purge => true, |
unless_system_user => 500, |
} |
root@fzt1mvzv8hybr6g:~# puppet apply resources.pp |
Notice: Compiled catalog for fzt1mvzv8hybr6g.delivery.puppetlabs.net in environment production in 0.02 seconds |
Notice: /Stage[main]/Main/User[foo]/ensure: removed |
Notice: /Stage[main]/Main/User[bar]/ensure: removed |
Notice: /Stage[main]/Main/User[baz]/ensure: removed |
Notice: /Stage[main]/Main/Group[foo]/ensure: removed |
Notice: Applied catalog in 0.24 seconds
|
|
