Puppet

I have a package (osirisd) that creates a user and group (both osirisd). My package resource is depended on by a file resource that copies the osiris management daemon certificate file to /var/lib/osirisd and attempts to change the owner and group of the file to “osirisd”.

This fails, I assume due to internal nameservice caching of puppetd.

If I run the same operations locally with puppet through a single script it appears to work, suggesting the same nameservice caching is not present in the puppet executable.

If I put a “sleep 5” in between the package installation and the file copy, the group can be set properly. A sleep of just 1 second fails though, in the same way as having no sleep.

debug: Puppet::Type::Package::ProviderApt: Executing '/usr/bin/apt-get -q -y -o DPkg::Options::=--force-confold install osirisd'
notice: //Node[gulf]/managed/osiris::complete/Package[osirisd]/ensure: ensure changed 'purged' to 'present'
info: //Node[gulf]/managed/osiris::complete/Package[osirisd]: Scheduling refresh of Exec[blah]
notice: //Node[gulf]/managed/osiris::complete/Exec[blah]: Triggering 'refresh' from 1 dependencies
debug: //Node[gulf]/managed/osiris::complete/Exec[blah]: Executing 'sleep 1'
debug: Executing 'sleep 1'
debug: //Node[gulf]/managed/osiris::complete/File[/var/lib/osirisd/osiris_root.pem]: File does not exist
debug: Calling fileserver.describe
debug: //Node[gulf]/managed/osiris::complete/File[/var/lib/osirisd/osiris_root.pem]: Changing ensure
debug: //Node[gulf]/managed/osiris::complete/File[/var/lib/osirisd/osiris_root.pem]: 1 change(s)
debug: Calling fileserver.retrieve
err: //Node[gulf]/managed/osiris::complete/File[/var/lib/osirisd/osiris_root.pem]/ensure: change from absent to file failed: Could not set file on ensure: Could not find group osirisd at /var/lib/puppet/modules/osiris/manifests/init.pp:65
notice: //Node[gulf]/managed/osiris::complete/Service[osirisd]: Dependency file[/var/lib/osirisd/osiris_root.pem] has 1 failures
warning: //Node[gulf]/managed/osiris::complete/Service[osirisd]: Skipping because of failed dependencies

I propose any nameservice caching be invalidated when an operation is carried out that may invalidate it, e.g. built-in user/group operations, package installs, perhaps even execs.