Verified to still be a valid issue with fss role. Apache files placed with apache::mod_conf are likely to have the same problem. Both php::ini and apache::mod_conf support ensure => absent but do not automatically clean up files.

I'm not sure there is a better answer than "rebuild your VM after you remove roles if you need to ensure that all resources are cleaned up". This is in line with the "treat servers as cattle not pets" concept of virtualized computing.

At the same time, though, this works for the files in settings.d/puppet-managed . So it seems like it may be possible here too.

settings.d/puppet-managed uses Puppet's recursive management functionality. This instructs puppet to remove any files in the directory or a sub directory that isn't explicitly managed by puppet during the current Puppet run.

If we were to do this with the php ini files we would need to manage all of the files explicitly in our puppet manifests.

(In reply to Bryan Davis from comment #3)

settings.d/puppet-managed uses Puppet's recursive management functionality.
This instructs puppet to remove any files in the directory or a sub
directory that isn't explicitly managed by puppet during the current Puppet
run.

If we were to do this with the php ini files we would need to manage all of
the files explicitly in our puppet manifests.

Not necessarily. Puppet File resources representing recursively-managed directories take an 'ignore' parameter that lets you specify a filename pattern which Puppet should not manage. If we give all Puppet-managed files some predictable filename pattern, we could tell Puppet to ignore everything that doesn't match that pattern.

Change 147543 had a related patch set uploaded by Ori.livneh:
Manage /etc/php5/mods-available recursively

https://gerrit.wikimedia.org/r/147543

Change 147543 merged by jenkins-bot:
Manage /etc/php5/mods-available recursively

https://gerrit.wikimedia.org/r/147543