puppetlabs/puppet · error · ArgumentError

Cannot have both `ensure => disabled` and `enable_only => tr

Error message

Cannot have both `ensure => disabled` and `enable_only => true`

What it means

Puppet's package type parameter `enable_only => true` restricts Puppet to managing only the package's service enablement state (no install/update). The validate block rejects combining it with `ensure => disabled`, because 'disabled' is an ensure state that itself means 'install nothing and disable the service' — enabling-only management of a package you also declare disabled is contradictory. It raises ArgumentError at catalog compilation time (lib/puppet/type/package.rb:523).

Source

Thrown at lib/puppet/type/package.rb:523

    newparam(:enable_only, :boolean => false, :parent => Puppet::Parameter::Boolean) do
      desc <<-EOT
        Tells `dnf module` to only enable a specific module, instead
        of installing its default profile.

        Modules with no default profile will be enabled automatically
        without the use of this parameter.

        Conflicts with the `flavor` property, which selects a profile
        to install.
      EOT
      defaultto false

      validate do |value|
        if [true, :true, "true"].include?(value) && @resource[:flavor]
          raise ArgumentError, _('Cannot have both `enable_only => true` and `flavor`')
        end
        if [:disabled, "disabled"].include?(@resource[:ensure])
          raise ArgumentError, _('Cannot have both `ensure => disabled` and `enable_only => true`')
        end
      end
    end

    newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
      desc <<-EOT
        It should be set for packages that should only ever be installed,
        never updated. Kernels in particular fall into this category.
      EOT
      defaultto false
    end

    newparam(:install_options, :parent => Puppet::Parameter::PackageOptions, :required_features => :install_options) do
      desc <<-EOT
        An array of additional options to pass when installing a package. These
        options are package-specific, and should be documented by the software
        vendor.  One commonly implemented option is `INSTALLDIR`:

View on GitHub (pinned to e227c27540)

Solutions

1. Remove `enable_only => true` and keep `ensure => disabled` — it already disables the service without installing
2. Keep `enable_only => true` but change ensure to an installed state (e.g. `ensure => installed`) and disable the service with `enable => false`
3. In wrapper classes, parametrize both values and fail() early with your own message when the pair is contradictory

Example fix

# before
package { 'telnet':
  ensure      => disabled,
  enable_only => true,
}

# after
package { 'telnet':
  ensure => disabled,
}

# wrapper class guard, before declaring the package
if $enable_only and $ensure == 'disabled' {
  fail("package '${title}': enable_only => true cannot be combined with ensure => disabled")
}
package { $title:
  ensure      => $ensure,
  enable_only => $enable_only,
}

def enable_only_compatible?(ensure_val, enable_only)
  !(enable_only && ensure_val.to_s == 'disabled')
end

begin
  Puppet::Type.type(:package).new(
    name: 'telnet', ensure: :disabled, enable_only: true
  )
rescue ArgumentError => e
  # deterministic misconfiguration; fix inputs, do not retry
  raise unless e.message.include?('enable_only')
end

When it happens

Trigger: Declaring `package { 'x': ensure => disabled, enable_only => true }` (symbol or string form of 'disabled'); wrapper classes/modules that parametrize `$ensure` while hardcoding `enable_only => true`, so a Hiera value of 'disabled' trips it during compile.

Common situations: Hardening profiles that disable optional packages meeting shared package defines that always set enable_only; refactors where `ensure => disabled` replaced older `ensure => absent` + `enable => false` combos; copy-paste from Windows/NuGet package examples that use enable_only.

Related errors

• You cannot use "mark" property while "ensure" is one of ["ab
• Find %{uri} resulted in 404 with the message: %{body}
• Find %{uri} resulted in 404 with the message: %{body}
• Invalid %{resource} provider '%{provider_class}'
• Name must be a String not %{klass}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/aa01c0f9748ecd17. Report an issue: GitHub.