Question: if we manage group membership on Linux via the

groups

param of users, is there a way to ensure a group only has the members who puppet is currently putting into the group? For example, say I have Alice and Bob both in group

admins

via the groups param of their respective user resourcesand a group resource for the admins group. Then Bob changes teams and his user resource no longer has

admins

in the

groups

param. I want Puppet to ensure that the admins group in

/etc/groups

only has Alice in it / I want puppet to remove Bob from the admins group.