So just for kicks I tried simply commenting out the whole purge section: # package { 'chrony': # ensure => 'purged', # before => Service['ntp'], # } And I still get 5 restarts of ntp when redeploying the overcloud: 2017-02-18 08:06:26 +0000 /Stage[main]/Ntp/Anchor[ntp::begin]/before (debug): subscribes to Class[Ntp::Install] 2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Install/before (debug): subscribes to Class[Ntp::Config] 2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Config/notify (debug): subscribes to Class[Ntp::Service] 2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Service/before (debug): subscribes to Anchor[ntp::end] 2017-02-18 08:06:26 +0000 /Stage[main]/Ntp::Service/Service[ntp]/before (debug): subscribes to Class[Tripleo::Firewall::Post] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Package[iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Package[iptables-services] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[firewalld] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autorequire relationship with Service[ip6tables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autobefore relationship with File[/etc/sysconfig/iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv4] (debug): Adding autobefore relationship with File[/etc/sysconfig/ip6tables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Package[iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Package[iptables-services] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[firewalld] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autorequire relationship with Service[ip6tables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autobefore relationship with File[/etc/sysconfig/iptables] 2017-02-18 08:06:27 +0000 /Firewall[105 ntp ipv6] (debug): Adding autobefore relationship with File[/etc/sysconfig/ip6tables] 2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/rpm -q ntp --nosignature --nodigest --qf %{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION} %{RELEASE} %{ARCH}\n' 2017-02-18 08:06:28 +0000 Puppet (info): Computing checksum on file /etc/ntp.conf 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf] (info): Filebucketed /etc/ntp.conf to puppet with sum c07b9a377faea45b96b7d3bf8976004b 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf]/content (notice): content changed '{md5}c07b9a377faea45b96b7d3bf8976004b' to '{md5}ff273154a520ecc0e21c25db677de324' 2017-02-18 08:06:28 +0000 /File[/etc/ntp.conf]/seltype (notice): seltype changed 'etc_t' to 'net_conf_t' 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf] (debug): The container Class[Ntp::Config] will propagate my refresh event 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Config/File[/etc/ntp.conf] (debug): The container Class[Ntp::Config] will propagate my refresh event 2017-02-18 08:06:28 +0000 Class[Ntp::Config] (debug): The container Stage[main] will propagate my refresh event 2017-02-18 08:06:28 +0000 Class[Ntp::Config] (info): Scheduling refresh of Class[Ntp::Service] 2017-02-18 08:06:28 +0000 Class[Ntp::Service] (info): Scheduling refresh of Service[ntp] 2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/systemctl is-active ntpd' 2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/systemctl is-enabled ntpd' 2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/systemctl is-active ntpd' 2017-02-18 08:06:28 +0000 Puppet (debug): Executing: '/usr/bin/systemctl restart ntpd' 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Service/Service[ntp] (notice): Triggered 'refresh' from 1 events 2017-02-18 08:06:28 +0000 /Stage[main]/Ntp::Service/Service[ntp] (debug): The container Class[Ntp::Service] will propagate my refresh event 2017-02-18 08:06:28 +0000 Class[Ntp::Service] (debug): The container Stage[main] will propagate my refresh event