Puppet runs not idempotent (lack of "unless" checks on execs)

[jistr]

Yanis reported an issue that we don't have idempotency in the puppet runs (there is real idempotency AFAICT, but Puppet doesn't know about it because it thinks it needs to run the execs every time). This results in puppet reporting that it made changes even though no changes were actually made on the machine. Here's an output that Yanis shared:

[root@ov-tr42och67st-0-ms6oltz4nv65-controller-cbulkq6ubexw heat-admin]# FACTER_heat_outputs_path="/var/run/heat-config/heat-config-puppet/c6253309-f3f9-4617-865c-4e73be5281bf"  FACTER_deploy_config_name="overcloud-ControllerNodesPostDeployment-anqlycwwqh5l-ControllerPuppetConfig-vsiqxfv5l7vp"  puppet apply --detailed-exitcodes /var/lib/heat-config/heat-config-puppet/c6253309-f3f9-4617-865c-4e73be5281bf.pp
Warning: Variable access via 'notification_email_to' is deprecated. Use '@notification_email_to' instead. template[/etc/puppet/modules/keepalived/templates/global_config.erb]:3
   (at /usr/share/ruby/vendor_ruby/puppet/parser/templatewrapper.rb:76:in `method_missing')
Warning: notify is a metaparam; this value will inherit to all contained resources in the keepalived::instance definition
Notice: Compiled catalog for ov-tr42och67st-0-ms6oltz4nv65-controller-cbulkq6ubexw.novalocal in environment production in 10.46 seconds
Notice: /Stage[main]/Pacemaker::Install/Package[fence-agents-all]/ensure: created
Notice: /Stage[main]/Pacemaker::Corosync/Exec[enable-not-start-tripleo_cluster]/returns: executed successfully
Notice: /Stage[main]/Pacemaker::Corosync/Exec[Set password for hacluster user on tripleo_cluster]/returns: executed successfully
Notice: /Stage[main]/Pacemaker::Corosync/Exec[auth-successful-across-all-nodes]/returns: executed successfully
Notice: Pacemaker has reported quorum achieved
Notice: /Stage[main]/Pacemaker::Corosync/Notify[pacemaker settled]/message: defined 'message' as 'Pacemaker has reported quorum achieved'
Notice: Finished catalog run in 17.09 seconds
[root@ov-tr42och67st-0-ms6oltz4nv65-controller-cbulkq6ubexw heat-admin]# FACTER_heat_outputs_path="/var/run/heat-config/heat-config-puppet/c6253309-f3f9-4617-865c-4e73be5281bf"  FACTER_deploy_config_name="overcloud-ControllerNodesPostDeployment-anqlycwwqh5l-ControllerPuppetConfig-vsiqxfv5l7vp"  puppet apply --detailed-exitcodes /var/lib/heat-config/heat-config-puppet/c6253309-f3f9-4617-865c-4e73be5281bf.pp
Warning: Variable access via 'notification_email_to' is deprecated. Use '@notification_email_to' instead. template[/etc/puppet/modules/keepalived/templates/global_config.erb]:3
   (at /usr/share/ruby/vendor_ruby/puppet/parser/templatewrapper.rb:76:in `method_missing')
Warning: notify is a metaparam; this value will inherit to all contained resources in the keepalived::instance definition
Notice: Compiled catalog for ov-tr42och67st-0-ms6oltz4nv65-controller-cbulkq6ubexw.novalocal in environment production in 8.18 seconds
Notice: /Stage[main]/Pacemaker::Install/Package[fence-agents-all]/ensure: created
Notice: /Stage[main]/Pacemaker::Corosync/Exec[enable-not-start-tripleo_cluster]/returns: executed successfully
Notice: /Stage[main]/Pacemaker::Corosync/Exec[Set password for hacluster user on tripleo_cluster]/returns: executed successfully
Notice: /Stage[main]/Pacemaker::Corosync/Exec[auth-successful-across-all-nodes]/returns: executed successfully
Notice: Pacemaker has reported quorum achieved
Notice: /Stage[main]/Pacemaker::Corosync/Notify[pacemaker settled]/message: defined 'message' as 'Pacemaker has reported quorum achieved'
Notice: Finished catalog run in 17.84 seconds
[root@ov-tr42och67st-0-ms6oltz4nv65-controller-cbulkq6ubexw heat-admin]# echo $?
2