Grant option requires a password hash or plain text password.

[nerdyness]

The documentation mentions:

Databases and permissions.

percona::database { 'dbfoo':
 ensure => present;
}
percona::rights {'userbar on dbfoo':
 priv     => 'select_priv',
 host     => 'localhost',
 database => '*',
 password => 'default',
}
# You can ommit the user, host and database parameter if you use this format:
percona::rights {'user@localhost/dbname':
 priv => 'all'
}

However when I try this using:

  percona::rights {'kodi@172.20.20.%/MyMusic%':
    priv => 'all'
  }

I get "Error: Could not retrieve catalog from remote server: Error 400 on SERVER: You must either provide the password hash to use or a plaintext password at /etc/puppet/modules/percona/manifests/rights.pp:97" as per this.

I didn't spend much time looking at this but do you agree this check is better suited after line 129 ?