The best that I can tell is that this code traces back to David Schmitt. It has been forked many times since then :)

1. you cannot add databases to an instance that has a root password
2. you cannot change the password for an instance
  (it all works from the command line, just not from puppet)

  I think that I fixed this. You have to specify the old password if you want to change it.
  
3. you have to specify username as USER@BLAH or it cannot be found
4. mysql_grant does not complain if user does not exist