What Puppet resource types require an audit metaparameter to force Puppet to manage the resource if it’s removed

puppet

Until recently, I was under the impression that merely declaring a resource with various attributes would ensure that Puppet manages the resource and brings it back to the configured state if it were to change.

Today, I found that wasn't the case for a yumrepo resource I have configured, until I added an audit => all metaparameter to the resource. I deleted /etc/yum.repos.d/foo.repo and ran puppetd --test. Puppet did not recreate the resource. Does that indicate a Puppet defect?

If that's the intended behavior, it begs the question, what other resources require audit => all to tell Puppet to manage the resource's state if it changes on the system under management?

Here is the repository class:

class yum::therepo {
    # Temporarily remove the Yum repo configuration if we don't have
    # httpd yet.
    exec { 'disable-the-repo-to-get-its-dependencies':
        provider => shell,
        command => 'rm -f /etc/yum.repos.d/the.repo',
        unless => 'rpm -q httpd',
        onlyif => 'test -f /etc/yum.repos.d/the.repo',
        before => [Package['httpd'], Exec['httpd-for-yum'],],
        path => '/bin:/usr/bin',
    }

    # Ensures httpd is running as a Yum server before anything else
    # tries to install packages from it.
    exec { 'httpd-for-yum':
        provider => shell,
        command => '/sbin/service nginx stop || true ; /sbin/service httpd restart',
        require => Class['yum::server'],
    }

    yumrepo {
        "the":
            require    => [Exec['httpd-for-yum'],],
            descr      => "The YUM Repo",
            baseurl    => "http://yum/repos/redhat/5/x86_64/",
            gpgcheck   => "0",
            enabled    => "1",

            # One puppet run failed to recreate the.repo. I added audit
            # => all, and the next puppet run did recreate the.repo.
            # Possibly a red herring. I'd like to understand why it
            # worked in one case and not in the other.
            #audit      => all,
    }
}

And the Yum server class:

class yum::server {
    include httpd
    include iptables

    package { ['createrepo']:
        ensure => present;
    }

    exec { 'update-repo-metadata':
        require => [ Package['createrepo']],
        cwd => '/var/www/html/yum',
        command => '/usr/bin/createrepo --update -d repos/redhat/5/x86_64/',
        creates => '/var/www/html/yum/repos/redhat/5/x86_64/repodata/repomd.xml',
    }

    file {'/etc/httpd/conf.d/yum.conf':
        ensure  => file,
        mode    => 0644,
        source  => "puppet:///modules/yum/yum_httpd.conf",
        require => Package['httpd'],
        notify  => Service['httpd'],
    }
}

Best Answer

I think you're misunderstanding the audit flag, but could you post your yum resource section, as that'd help alot. Typically, no, you don't need audit on a yumrepo resource to make it create a .repo file.

http://puppetlabs.com/blog/all-about-auditing-with-puppet/

Related Topic