add ensure parameter

README.md

-# su_kerberos
+[[_TOC_]]
+
+# `su_kerberos` Puppet Class
 
 ## Quick Start
 
-Use this package to install Kerberos client software and the
+Use this Puppet class to install Kerberos client software and the
 Stanford-recommended version of `/etc/krb5.conf`:
 ```
 include su_kerberos
@@ -10,13 +12,26 @@ include su_kerberos
 
 ## Configuration parameters
 
+* `ensure`: one of "absent" or "present". If "present" will install the
+appropriate kerberos client package and install the /etc/krb5.conf file
+(unless the `manage_etc_krb5conf` parameter is set to false). If "absent"
+will ensure that the appropriate package is NOT present and will remove
+`/etc/krb5.conf` (unless the $manage_etc_krb5conf parameter is set to
+false). Recommendation: only set to absent if you are absolutely sure you
+will not need to use *any* Kerberos-based applications.  Default:
+"present".
+
 * `debian_client`: if the server where this Puppet module runs is Debian,
 this parameter determines which kerberos client package you will
 install. Its value must be one of `mit` or `heimdal`; the default is
 `mit`. If the server is not Debian this parameter has no effect.
 
 * `manage_etc_krb5conf`: if set to true (the default) will install the
-Stanford-recommended version of `/etc/krb5.conf` by the krb5conf Puppet
-module. Set this to false if you want to manage `/etc/krb5.conf` in some
+Stanford-recommended version of `/etc/krb5.conf` by the `krb5conf` Puppet
+module. Set this to `false` if you want to manage `/etc/krb5.conf` in some
 other class.
 
+## Notes
+
+* Do **not** use this class with a Kerberos server as a Kerberos server
+usually requires a highly-customized Kerberos configuration.

manifests/init.pp

 # Set up basic Kerberos configuration.
 
-# Do not use this class with Kerberos server as a Kerberos server usually
-# requires a customized Kerberos configuration.
+# Do **not** use this class with a Kerberos server as a Kerberos server
+# usually requires a highly-customized Kerberos configuration.
+
+# $ensure: one of "absent" or "present". If "present" will install the
+# appropriate kerberos client package and install the /etc/krb5.conf file
+# (unless the $manage_etc_krb5conf parameter is set to false). If "absent"
+# will ensure that the appropriate package is NOT present and will remove
+# /etc/krb5.conf (unless the $manage_etc_krb5conf parameter is set to
+# false). Default: "present".
 
 # $manage_etc_krb5conf: if set to true (the default) will install the
 # Stanford-recommended version of /etc/krb5.conf using the krb5conf Puppet
@@ -13,19 +20,20 @@
 # is "mit'.
 
 class su_kerberos (
-  Boolean                $manage_etc_krb5conf = true,
-  Enum['heimdal', 'mit'] $debian_client       = 'mit',
+  Enum['present', 'absent'] $ensure              = 'present',
+  Boolean                   $manage_etc_krb5conf = true,
+  Enum['heimdal', 'mit']    $debian_client       = 'mit',
 ) {
 
   # Step 1. Install the kerberos client.
   case $::osfamily {
     'RedHat': {
-      package { 'krb5-workstation': ensure => present }
+      package { 'krb5-workstation': ensure => $ensure }
     }
     'Debian': {
       case $debian_client {
-        'mit':     { package { 'krb5-user':       ensure => present } }
-        'heimdal': { package { 'heimdal-clients': ensure => present } }
+        'mit':     { package { 'krb5-user':       ensure => $ensure } }
+        'heimdal': { package { 'heimdal-clients': ensure => $ensure } }
         default:   { fail("unsupported debian_client value '${debian_client}'") }
       }
     }
@@ -37,8 +45,14 @@ class su_kerberos (
   # Step 2. Install the default /etc/krb5.conf file appropriate for
   # Stanford.
   if ($manage_etc_krb5conf) {
-    krb5conf { '/etc/krb5.conf':
-      appdefaults_file => 'krb5conf/appdefaults',
+    if ($ensure == "present") {
+      krb5conf { '/etc/krb5.conf':
+        appdefaults_file => 'krb5conf/appdefaults',
+      }
+    } else {
+      file { '/etc/krb5.conf':
+        ensure => absent,
+      }
     }
   }