Next, use refreshonly to instruct the exec resource to only apply a change if the vcsrepo repo effected a change (vis a vis non-idempotent):. Specify multiple resources as an array of references. 04; In Puppet, the combined configuration to be applied to a host is called a catalog, and the process of applying it is called a run. Menu Log In List your. The default behavior is to report the exit code only for the last command in the pipeline. I'm using it in entirely different places of my code. Your operating system and firewall must allow Puppet agent to initiate outbound connections on this port. If a resource subscribes. And the exec command will execute onlyif the file '/etc/init. A manifest is a file containing Puppet configuration language that describes how resources should be configured. Resource references identify a specific Puppet resource by its type and title. Whether to manage the home directory when Puppet creates or removes the user. There are three main ways for an exec to be idempotent:Puppet: How to execute a Exec resource if another Exec resource failed. How do I do this? Similar to referencing File['name']. g. require means that the the resource passed to require must be applied before the calling resource. ) (See the notes on refreshing below. Yes, via the notify meta-parameter. bashrc'", subscribe => File ["/root/. This tool is a part of the policycoreutils-python package, which is not installed on Red Hat Enterprise Linux systems by default. 4+, your original code would be possible. cmd', provider => windows, subscribe => File ['folder_a'], logoutput => true, refreshonly => true, # Add this line. Expand Resources are the fundamental unit for modeling system configurations. Use the short service name (such as wuauserv) in Puppet, not the display name (such as Automatic Updates ). That means this approach checks the existence of /path/to/directory/. , Perforce Software, Inc. 0 through 3. Parameters change how Puppet manages a resource, but do not necessarily map directly to something measurable. (See the notes on refreshing below. (See the notes on refreshing below. Add classes from the privileges and sudo modules to your agents. It is safer to regard exec resources as the last resort or emergency exit that is only to be used if all other alternatives have been exhausted. The . Resource Type Reference (Single-Page) Built-in types This page provides a reference guide for Puppet 's built-in types: package, file, service, notify, exec, user, and group. Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Valid options: 'always' (at every Puppet run); daily' (if the value of apt_update_last_success is less than current epoch time minus 86400); 'weekly' (if the value of apt_update_last_success is less than current epoch time minus 604800); 'reluctantly. It's important to note that the notify resource type is not idempotent. In addition to the resource types included with Puppet, you can install custom resource types as modules from the Forge. (See the notes on refreshing below. Puppet contains resource types to manage some SELinux functions, such as. 10. The Puppet exec resource has OnlyIf and Unless attributes which can be used to limit when the command is invoked; e. exec. What I am trying to solve is this: Our server code (rails) is deployed as a tar file (puppet file resource), tar file is extracted (puppet exec) and database is migrated (puppet exec). Puppet Resources are the building blocks that puppet uses to model system configurations. exec { 'foobar': command => 'foo | bar', } However, there are occasions where foo fails. ). The implementation matches the full line, including whitespace at the beginning and end. Hence, I used an exec resource, relying on Powershell, just before the dsc resource:If the exec resource apt_update is notified, apt-get update runs regardless of this value. newtype (:yumgroup) do @doc = "Manage Yum groups A typical rule will look like this: yumgroup { 'Development tools': ensure => present, } " ensurable newparam (:name) do isnamevar desc 'The name of the group' end end. password is not getting changed to the default password and also chage. A manifest is a file containing Puppet configuration language that describes how resources should be configured. The exec has refreshonly => true, which allows Puppet to run the command only when some other resource is changed. ) The state managed by an exec resource represents whether the specified command needs to be executed during the catalog run. A complete service resource is very simple: service { 'mysql': ensure => 'running', enable. Providers. I have a class that executes a DSC resource, but required to wait for 20 seconds, before it executes it. exec; Exec tips and examples for Windows; file; File tips and examples for Windows. specified as a string, to the agent run-time log. In the minimal example above we first give the command a. Data type: Optional[String] the source file (either a puppet URI or local file) of the SELinux . ) The state managed by an exec resource represents whether the specified command needs to be executed during the catalog run. For example, if you manage nginx with puppet, and want to upgrade it, puppet needs to probably stop the service before it updates the code dir and then start it again. It modifies the environment of a shell that has been forked specifically for this exec resource. 1. d/ serves a special purpose, and your expectation for how it might be appropriate to use a file within is not consistent with that purpose. Second: The order depends on a few things. ) The name of the service to run. If Puppet is managing any role accounts corresponding to the user’s roles, the user resource will autorequire those role accounts. However, the problem with the exec is that it is not idempotent. Improve this answer. Earlier versions may behave differently. (Namevar: If omitted, this attribute's value defaults to the resource's title. But either way the trailing exit statement in the command will return a non-zero exit code if that happens. A resource describes something about the state of the system, such as a certain user or file should exist, or a package should be installed. (To take an example from Windows, you would use "wuauserv" rather than "Automatic. jar', } Should this be part of the manifest which could look like this?Exec resources do not work that way. It is messy and not best practice though. 1. Exec is a very useful resource type present in Puppet which is used to executes external commands. Inheritance is a process whereby a Puppet class can be derived from another class by using the inherits keyword. (This is the preferred method for backup, since it can be centralized and queried. Since Puppet uses the same exec resource type on both *nix and Windows systems, there are a few Windows-specific caveats to keep in mind. To use sudo non-interactively, the invoking user needs a NOPASSWD: entry in sudoers %wheel ALL=(fred) NOPASSWD: /usr/bin/echo "hola dan" Then. If the line is not contained in the given file, Puppet will append the line to the end of the file to ensure the desired state. jar', } Should this be part of the manifest which could look like this? Exec resources do not work that way. What you would need is a way to implement this process: check if resource A (a package, say) needs a sync action (e. ) The name of the service to run. exec { "initialize-footool": require => Package ["footool"] } file { "/etc/default/footool": before => Exec ["initialize-footool"] } read more like english than just requires on the exec. is there a way how to ensure the reboot of the linux machine after puppet run? Can take advantage of reboot or shutdown -r commands and to typical patern resurce - subscribe pattern but that doesn't ensure that exec shutdown resource will be synchronized as a last one. Chaining arrows. Puppet uses the same exec resource type on both *nix and Windows systems, and there are a few Windows-specific best practices and tips to keep in mind. You cannot use an Exec resource to perform the check, because you need to perform the evaluation during catalog building, and resources are not applied until after the catalog is built. ) A caution: There’s a widespread tendency to use collections of execs to manage resources that aren’t covered by an existing resource type. exe /c java -jar foo. This page provides a reference guide for the core Puppet types: package, file, service, notify, exec, cron, user, and group. If a mount receives an event from another resource and its ensure. I am poorly familiar with the puppet language but would guess something like this to execute the jar file: exec { 'jar_execution': command => 'cmd. To ensure the resource is idempotent, specify one of the creates, onlyif, or unless attributes. (Just tested similar configuration with Puppet 2. (See the notes on refreshing below. creates. exec { 'echo /my/update/script | at now+10min': } so that the puppet agent process is not the parent of the yum instance that will do all the work. Puppet does however attempt to track whether a resource has changed state. If you declare a resource, it is expected that puppet brings your machine to that state (installed package) and if not, it will fail automatically. As for what you are trying to achieve, I recommend a combination of declaring Exec resources belonging to the class as being refreshonly (which might be conveniently achieved by declaring that as a resource default) and allowing other resources to sync. If a given resource is already in the desired state, Puppet performs no actions. pp --ordering=random ). 4. Puppet ’s property support has a helper method called. I am poorly familiar with the puppet language but would guess something like this to execute the jar file: exec { 'jar_execution': command => 'cmd. The command must be idempotent. source_fc. Given that, you can use a lambda iterator on the hash. 0. (To take an example from Windows, you would use "wuauserv" rather than. An exec resource, which starts a powershell script, which starts a PowerShell process, which starts a CMD process, which runs a batch file (with an invalid path), which runs another batch file, which processes some kind of response file. Additionally, some resources like exec will support attributes that work like a conditional, but only accept a command output as condition. Puppet uses the same exec resource type on both *nix and Windows systems, and there are a few Windows-specific best practices and tips to keep in mind. 0. Puppet agent runs as a specific user, by default LocalSystem, and initiates outbound connections on port 8140. Hot Network Questions Is there a permanent way to gain access to the Healing Domain as a Cleric whose deity doesn't include it in their portfolio?So, in order to avoid this I am adding the refreshonly parameter as follows. Is it possible to exec resource only when another exec resource is failed. To ensure the resource is idempotent, specify one of the creates, onlyif, or unless attributes. The actual behavior depends on the value of the ‘ensure’ parameter. give it a "high level" description of what you want (using the jboss::apps defined type), and include a description of what it is (by including the corresponding modules on the client); provide a. For information on all core types, including supported types in the puppet-agent package, see. For your specific case, perhaps running puppet in verbose or debug mode will work. By specifying the URL in a source parameter you can put an actual descriptive. I'm afraid this sofware isn't installed on my windows puppet agent. All resource types (single-page reference) Core types cheat sheet; Optional resource types for Windows; augeas; Augeas tips and examples. However, if all you want is to. If this parameter is set, then this exec will only run if the command has an exit code. Posted: Wed 05 Oct, 2016, 18:15. Related. Answer. file { '/var/owner => 'recurse => true, } As a matter of fact, Puppet currently cannot automatically create all parent directories. To use sudo non-interactively, the invoking user needs a NOPASSWD: entry in sudoers. There are a few important parameters to use when writing an exec resource with PowerShell. As a last resort, Puppet will attempt to search the process table by calling whatever command is listed in the ps fact. approved. Hot Network Questions Online shopping: order date vs shipping date vs charge date Recent advances in computer science since 2010? Useful ideas in category theory which violate the principle of equivalence Can I lessen the use of boolean flag variables in this snippet?. Writing Manifests for Windows. Puppet doesn't have all the pathing/env variables you're used to as a regular user, so you need to be. When using exec resources with the powershell provider, the command parameter must be single-quoted to prevent Puppet from interpolating $(. This can be used with bash on Linux, but with the PowerShell provider , it can run PowerShell on Windows and Linux nodes as well. When a resource is "changed", then it notifies any resources subscribed to its own change. disable_keys: Disables the requirement for all packages to be signed. com to sign the CSR. * Given your manifest, Puppet only promises that the Exec resource - if it is applied at all - will always be applied before the File resource. 4. The period of repetition for resources on this schedule. This page provides a reference guide for Puppet 's built-in types: package, file, service, notify, exec, user, and group. They usually do this. Defined resource types , sometimes called defined types or defines, are blocks of Puppet code that can be evaluated multiple times with different parameters. If a given resource is not in the desired state, Puppet takes whatever action is necessary to put. Run puppet exec command only if output file has changed. Puppet Exec resource to apply only when a File changes. ; Optional resource types for Windows In addition to the resource types included with Puppet, you can install custom resource types as modules from the Forge. If the exec resource apt_update is notified, apt-get update runs regardless of this value. Open source Puppet docs for recent end-of-life (EOL) product versions are archived in place, meaning that we continue to host them at their original URLs, but we limit their visibility on the main docs site and no longer update them. Puppet can run binary files (such as exe, com, or bat ), and can log the child process output and exit status. That command will always return 0 (true): it just tests whether the given string is nonempty. The file type can manage normal files, directories, and symlinks; the type should be specified in the ensure attribute. Puppet automates the delivery and operation of the software that powers some of the biggest brands in. It sounds like this is exactly what you need: exec { 'test_cmd': path => $::path, command => 'cmd. Takes a single numeric value as an argument. exec { 'Task1': command => '/bin/long-running-task', timeout => 3600, } If this long running task fails or times out, it'd be optimal to get a notification of this failure. Fortunately, Puppet also allows users to change the provider used for the exec resource to PowerShell, so that Windows Puppet nodes will run PowerShell commands. Note Serverspec is also what people generally use to solve this problem for Ansible and Chef also. e. user. The value that represents the data type of these values is Type. The most important point that I was trying to convey to you in my previous message was that Puppet does not use a mechanism anything like that to set up the environment for the Exec's commands. For instance, to rename the Guest account:. Puppet User and GroupPuppet::Type. The notifying arrow is a tilde and a greater-than sign ( ~> ). Classes and defined type instances contain the resources they declare. Puppet training is available as "online live training" or "onsite live training". Among them, notice (), info (), and debug () seem the. (See the notes on refreshing below. 5. source_te. – Felix Frank. The Puppet “exec” resource allows users to run commands and scripts on nodes. To make an exec resource fit into Puppet’s model better, you should use one of the following parameters instead. (See the notes on refreshing below. pp ). and if it is not by default, at least there should be an option in puppet exec to do so (equivalent to "set . The refreshonly true will assure you that the script will be executed only if it is notified. It applies the resource on the left before the resource on the right. If you are using Puppet 3. On the Puppet master, create the directory structure for a module named lamp: cd /etc/puppet/modules sudo mkdir -p lamp /manifests. For instance, in this example manifest, I want to run a PowerShell command that adds the string “Hello” to the contents of a text file (“C: est. exec { 'tar -xf /Volumes/nfs02/important. Conditional statements let your Puppet code behave differently in different situations. Ports. specified as a string, to the agent run-time log. Note that the period defines how often a given resource will get applied but not when; if you would like to restrict the hours that a given resource can be applied (for instance, only at night during a maintenance. I'm just suggesting a possible reason for the downvote on your answer, regardless of whether it was strictly-speaking. In your command prompt, run: puppet resource registry_key 'HKLM\Software\Microsoft\Windows' 1. This resource allows you to execute a wlst command or script in the context. There are a few important parameters to use when writing an exec resource with PowerShell. Exec; Execute commands from Puppet Manifests; Globally Set Exec Paths; Nicer Exec Names; Run exec if file is missing; Control when an exec should run; Control Execs output; Services; Ensure service is running; Start service on boot; Ensure service is stopped; Don't start service on boot; Restart service when config changes; Facts and Facter. This can be used with bash on Linux, but with the. exec {. exec { "Change status and start-up of Win service": command => 'C:\Windows\System32\WindowsPowerShell\v1. I have used exec type to accomplish this. Puppet running exec before other commands. I have a puppet file with an exec resource and create_resources function. Iterative functions accept a block of code and run it in a specific way: each - Repeats a block of code. jar file is actually an update for an application which is running as a service. (See the notes on refreshing below. Puppet Exec Resource. The interfaces to the various helper manifests has been changed to be more in line with Puppet file resource naming conventions. ), and can log the child process output and exit status. Each key and value is converted to a string using these rules. ) (See the notes on refreshing below. Parameters. Puppet offers expert training in methods that work best for you. ) The state managed by an exec resource represents whether the specified command needs to be executed during the catalog run. It takes the environment strings you provide, as interpreted by Puppet at catalog-building time, and inserts them directly into the. Create exec resources with metadata to ensure it is idempotent. exec. The exec has refreshonly => true, which allows Puppet to run the command only when some other resource is changed. This isn't how Puppet works. exec { "Change status and start-up of Win service": command => 'C:WindowsSystem32WindowsPowerShellv1. As a result, notifications are shown as a change. But echo seems not work when the script is executed as an Exec resource in Puppet. Puppet uses the same exec resource type on both *nix and Windows systems, and there are a few Windows-specific best practices and tips to keep in mind. 7. Despite the -ExecutionPolicy parameter the PowerShell command will fail if execution is restricted via group policy. [puppet master ip] puppetmaster puppet [puppet client ip] puppetclient I understand that remote-exec runs after the resource is created. It basically means it will notify the exec when the file is deployed and that puppet will push the file before trying to execute it. ) (See the notes on refreshing below. This also makes it easier to read related resources, instead of the long and complicated command being used in the package resources require property here: class messy_exec_relations { exec. 0powershell. Returns the smallest Integer greater or equal to the argument. Sections. refreshonly. To run an exec task, use the task command, specifying the command to be executed. (See the notes on refreshing below. Could someone please advice the best approach?sudo puppet resource package puppet-server ensure=latest. 2. To complete our tour of the basic elements of a manifest, let's take a closer look at the resource types that you have already used, and some of the more import. More advanced usage. The creates parameter is probably not appropriate for this particular case, so choose one of unless or onlyif. pp) file. %wheel ALL= (fred) NOPASSWD: /usr/bin/echo "hola dan". class { selinux: mode => 'enforcing', type => 'targeted', } This will include the module and manage the SELinux mode (possible values are enforcing, permissive, and disabled) and enforcement type (possible values are targeted, minimum, and mls ). Execute create_resource after everything has finished or after exec has finished. In this case, the resource type is file. Puppet can execute binaries (exe, com, bat, etc. I'm currenlty using puppet open source. In this example, the title is C:Tempfoo. Each resource describes the desired state for some aspect of a system, like a specific service or package. Alternatively, if that is valid, call the prior script through the latter's onlyif or unless parameter, instead of as its own exec resource. In other words Puppet will be sure to execute apt. I have tried using the -> approach and notify => Exec[] but I'm unsure how to pass params in this case. I'm trying to purge from that directory all things that haven't been defined in my puppet code. As suggested in comments a "correct" solution would. puppetlabs-registry is a custom type and provider, so you can use puppet resource to look at existing registry settings. The Forge makes it easier for you to manage Puppet and can save you time by using pre-written modules, rather than writing. As a result, the chown in the main command always is run, and that is reported. I think that the simplest solution is to have the lifecycle of the 7-Zip package managed by exec resources rather than as package resources. It is messy and not best practice though. This is the documentation for Puppet's built-in resource types and providers. Generally speaking, details of machines' current state on which Puppet is to base. 0. Containment is the relationship that resources have to classes and defined types, determining what has to happen before other things can happen. Puppet can run. I am trying to run a Powershell command directly using Puppet exec resource instead of specifying path to the Powershell script. Behavior. NOTE: This page was generated from the Puppet source code on 2019-09-06 09:16:04 -0700 exec Attributes Providers Description Executes external commands. Puppet Server and Puppet ’s companion utilities Facter and Hiera, have their own CLI. You can, however, write several patterns that collectively match all the files. Renaming a file is specifying how to a achieve a desired state - it’s an imperative. (Namevar: If omitted, this attribute's value defaults to the resource's title. I'm using puppetforge puppetlabs/apt module so I wish to notify the Exec['apt_update'] resource from that module. Resource-like declarations. This name is used to find the service; on platforms where services have short system names and long display names, this should be the short name. I want to create a new file on a specific Puppet agent and store the output of a Linux command to the file. (See the notes on refreshing below. exec { 'chage': path => '/usr/bin/', command => 'chage -d 0 askar', subscribe => File ['askar'], refreshonly => true, } } I then verified that after applying the refreshonly parameter , the. This parameter doesn't cause Puppet to create a file; it is only useful if the command itself creates a file. 2 install on Ubuntu 18. For example:. Declaring providers. group. Just. The Puppet “exec” resource allows users to run commands and scripts on nodes. inheritance. notify. ) (See the notes on refreshing below. For instance, if you wanted to rename the Guest account. exec is a hack, but it's the only way to do it besides running Puppet multiple times. Interpreting the output of the puppet apply command; Adding control. When Puppet runs, it applies the exec resource by running the command: command => '/bin/echo `/bin/date` >/tmp/output. While naming limitations vary by operating system, it is advisable to restrict names to the lowest common denominator, which is a maximum of 8 characters. 1. The specific backend to use for this ora_exec resource. cat jayesh. Puppet uses the same exec resource type on both *nix and Windows systems, and there are a few Windows -specific best practices and tips to keep in mind. Puppet contains resource types to manage some SELinux functions, such as Booleans and modules. pp. On lamp-1, run this:Yes. Default path for exec resource with forman and puppet. The focus of the Puppet language is declaring resources, so most people want to use iteration to declare many similar resources at once. ), and can log the child process output and exit status. This shell then immediately terminates. To ensure the resource is idempotent, specify one of the creates, onlyif, or unless attributes. (See the notes on refreshing below. 0. I tested using an Exec with an unless parameter that emits the message, but Puppet does not seem to print the output of the unless command. txt', This command will write the following text to /tmp/output. That is mediated, where desired, by the resource's unless, onlyif, and / or creates parameters, as described in that resource type's documentation. I am using vagrant with puppet to set up virtual machines for development environments. The general form of a resource reference is: The resource type, capitalized. After the exec resource completes, we trigger a refresh of the firewalld service but with a subscribe attribute pointing to the firewall-cmd executable resource. This mostly works for me on Puppet 4. The file resource uses the title to determine where to create the file on disk. refreshonly. 6 will trigger a notify if the package version changes outside of puppet's control. 1. For instance, to. If a resource subscribes to another resource, then Puppet tries to "refresh" that resource if the resource it is subscribed to changes state. How to detect that a puppet run is complete. the code is working well with puppet apply, now when I am trying to write rspec test for the same, i am facing issues and getting failure messages. ) The state managed by an exec resource represents whether the specified command needs to be executed during the catalog run. com Resource tips and examples: Exec on Windows. One thing that you can do (and I don't recommend) and that is not "puppet way" is following:Making Puppet exec work The exec resource from Puppet, the automation framework, is a mysterious beast. Puppet Exec Resource. Learn more about TeamsOther built-in types. A puppet show is a great way to entertain the kiddos at your next event! Find the best puppet shows in Victoria, BC and request free quotes today. Providers implement the same resource type on different kinds of systems. Assuming your unspecified task is handled by an exec resource, you could design this in such a way that Puppet only ever regards the exec as out of sync once per day. Again, from an imperative approach this is fairly easy to deal with. Puppet agent runs as a specific user, by default LocalSystem, and initiates outbound connections on port 8140. If necessary, changes the system to enforce the desired state. Puppet code is composed primarily of resource declarations. When Puppet applies a catalog to the target system, it manages every resource in the catalog, ensuring the actual state matches the desired state. Instead of using loop keywords, the Puppet language uses iterative functions that accept blocks of code called lambdas. The external_nodes script receives the name of the node to classify as its first argument. You can get involved by fixing bugs, influencing new feature direction, publishing your modules, and engaging with the community to share knowledge and. Interpolation. , adding a search path for exec resources or controlling directory recursion on file resources). Puppet exec: shell command returns "could not find command" 0. Puppet 6. -> (ordering arrow; a hyphen and a greater-than sign) — Applies the resource on the left before the resource on the right. This is what I have so far:{"payload":{"allShortcutsEnabled":false,"fileTree":{"lib/puppet/type":{"items":[{"name":"file","path":"lib/puppet/type/file","contentType":"directory"},{"name. d. Multiple resources may be declared to manage multiple lines in the same file. It's much nicer to use a human readable explanation of what the command is for as the execs name and then put the actual command in the command property. ” There is also a set of values whose data type is “data type. When working with Puppet resources, you typically don’t need to worry about idempotence; most resource providers are idempotent by design. Exec['Wait for rabbitmq']. The derived. I want create_resources to be executed right after the exec resource. This function is backwards compatible with the same function in stdlib and accepts a Numeric value. Puppet uses the same exec resource type on both *nix and Windows systems, and there are a few Windows -specific best practices and tips to keep in mind. , adding a search path for exec resources or controlling directory recursion on file resources). fail when a file exist in puppet. When running Puppet commands on Windows, note the following: The location of puppet. macOS handles services much like most *nix -based systems. 8. The command should only be run as a refresh mechanism for when a dependent object is changed. This says "get-chocolatey" should happen before any package resource with a Chocolatey provider. Your require parameter is only indicating that the exec resources should be handled before the file resources, not that their "return value" should indicate whether to create the resource or not. You can also set variables within the manifest, which can change the. The PowerShell module uses a custom PowerShell host that ensures this data is cleared before each Puppet resource executes. For instance, in this example manifest, I want to run a PowerShell command that adds the string “Hello” to the contents of a text file (“C:\test. Those resources have a refresh method called on them, that does whatever that type requires. To expand on Matt's comment above, go to the server in question and run which pip to see pip's location (on my machine /usr/local/pip ), then append your exec command with the full path for pip, e. Create exec resources with metadata to ensure it is idempotent. The behaviour changed between Puppet 3 and 4. See the filebucket resource type for more details. Note the following details in this file resource example: Puppet uses a basic syntax of type { title: }, where type is the resource type. So likely not what the. user. group. . Default value: undef. Puppet: How to execute a Exec resource if another Exec resource failed. 1 Answer Sorted by: 1 The pasted code isn't really valid Puppet code, it's hard to guess what it's supposed to do. I would like to simply set a few environment variables in the . This means that you can allow other people access to the code, without access to the sensitive data in that code. What you present has no chance of working anything like how you intend. If a given resource is already in the desired state, Puppet performs no actions. This is especially useful when managing Windows systems. Since exec resources can be used to perform virtually any operation, they are sometimes abused to stand in for more proper resource types. Puppet doesn't provide a way to apply the same resource from the catalog multiple times, even in different run stages. Like, from scratch. Q&A for work. This example specifies defaults for the exec resource type attributes path , environment , logoutput , and timeout . If you're new to Puppet, we recommend the following resources to get you started: Learn Puppet. ) The state managed by an exec resource represents whether the specified command needs to be executed during the catalog run. Resource relationship chaining arrows. And as for the title of this question which I originally overlooked. Puppet is declarative - you tell it what state you want a system, and it goes and creates it.