admins.pp

class blah::admins {

  user { 'admin':
    ensure  => present,
    uid     => 1337,
    gid     => wheel,
    comment => 'Blah Administrator',
    shell   => '/bin/bash',
    home    => '/home/admin',
    managehome => true,
  }

  file { '/home/admin/.ssh':
    ensure  => directory,
    mode    => 600,
    owner   => admin,
    group   => wheel,
    subscribe => User['admin'],
  }
  
  #DEBUG: (this didn't help)  
  #file { '/home/admin/.ssh/authorized_keys':
  #  ensure  => present,
  #  mode    => 600,
  #  owner   => admin,
  #  group   => wheel,
  #  subscribe => User['admin'],
  #}

  ssh_authorized_key { 'oc@admin':
    ensure  => present,
    key => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAmZWL6WJML2kP4deIhCq/YY4DU+SXmXkpLgVvQMLJ+qggo6fXnG+bre/K7LOyC8nowl3qkBhFD/wq0c8LLlAqEeZ9o8lrwNIHck3dOtkri72UCm2CGWdLX4N36eI3wThSdbdiKVVpK9KRYjVqgs6f75raQ4NaDb9fc4j5sffDycYpJYibhu1ZcSL6TrnJQKVHUKysT0h9XnrR+/QaAs7fXG3LC+dMpj4dWQwa5nva5K93yyLlBY3fql5FeEVoVOmDz4dE5hPD+HtM9HIFWBf+Q644qjh9gtX4VEOQnk7y6vkn+gr+egwnJRe7Lse7J2Bb1vNednWFrBFBp0zPium5OQ==',
    user  => admin,
    type  => 'ssh-rsa',
  }

}

deployers.pp

class blah::deployers {
  group { 'deploy': ensure => present, gid => 2000 }

  user  { 'deploy':
    ensure => present,
    uid => 2000,
    gid => 2000,
    comment => 'Blah Deployment User',
    shell   => "/bin/bash",
    home    => "/home/deploy",
    managehome => true,
    notify  => File['/home/deploy/.ssh']
  }

  file { '/home/deploy/.ssh':
    ensure  => directory,
    mode    => 600,
    owner   => deploy,
    group   => deploy,
  }

  ssh_authorized_key { "oc@deploy":
    ensure  => present,
    key     => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAmZWL6WJML2kP4deIhCq/YY4DU+SXmXkpLgVvQMLJ+qggo6fXnG+bre/K7LOyC8nowl3qkBhFD/wq0c8LLlAqEeZ9o8lrwNIHck3dOtkri72UCm2CGWdLX4N36eI3wThSdbdiKVVpK9KRYjVqgs6f75raQ4NaDb9fc4j5sffDycYpJYibhu1ZcSL6TrnJQKVHUKysT0h9XnrR+/QaAs7fXG3LC+dMpj4dWQwa5nva5K93yyLlBY3fql5FeEVoVOmDz4dE5hPD+HtM9HIFWBf+Q644qjh9gtX4VEOQnk7y6vkn+gr+egwnJRe7Lse7J2Bb1vNednWFrBFBp0zPium5OQ==',
    user    => deploy,
    type    => 'ssh-rsa',
  }
}

Output

Dec  8 13:45:39 vagrant-host puppet-agent[1838]: (/Stage[main]/Blah::Deployers/Ssh_authorized_key[oc@deploy]/ensure) created
--
Dec  8 13:45:39 vagrant-host puppet-agent[1838]: (/Stage[main]/Blah::Deployers/Ssh_authorized_key[oc@deploy]) Could not evaluate: Puppet::Util::FileType::FileTypeFlat could not write /home/admin/.ssh/authorized_keys: Permission denied - /home/admin/.ssh/authorized_keys
--
WTF? Why does it try to write /home/admin/.ssh/authorized_keys for deploy user?