What causes "Resource instance does not match request key" in puppetlabs/puppet?

Derive the key from the instance itself instead of composing it separately: "#{resource.type}/#{resource.title}"

puppetlabs/puppet · error · Puppet::Indirector::ValidationError

Resource instance does not match request key

Error message

Resource instance does not match request key

What it means

Puppet::Resource::Validator#validate_key enforces that a resource request's key 'Type/Title' matches the attached resource instance: type must match case-insensitively (String#casecmp == 0) and title must match exactly. Any divergence raises Puppet::Indirector::ValidationError. It guards save/search paths of the resource indirection so a request cannot write an instance under a different type/title than the key it declares.

Source

Thrown at lib/puppet/indirector/resource/validator.rb:7

# frozen_string_literal: true

module Puppet::Resource::Validator
  def validate_key(request)
    type, title = request.key.split('/', 2)
    unless type.casecmp(request.instance.type).zero? and title == request.instance.title
      raise Puppet::Indirector::ValidationError, _("Resource instance does not match request key")
    end
  end
end

View on GitHub (pinned to e227c27540)

Solutions

Derive the key from the instance itself instead of composing it separately: "#{resource.type}/#{resource.title}"
Recreate the request after mutating a resource's title/type so key and instance stay in lockstep
Remember title matching is case-sensitive while type matching is not; align title strings exactly
In tests/factories, always build requests via Puppet::Resource.indirection.request(:save, res.ref, res)

Example fix

# before
res = Puppet::Resource.new(:service, 'httpd')
req = Puppet::Resource.indirection.request(:save, 'service/nginx', res)
req.validate  # => ValidationError: Resource instance does not match request key

# after
req = Puppet::Resource.indirection.request(:save, "#{res.type}/#{res.title}", res)
req.validate  # passes

Defensive patterns

Strategy: validation

Validate before calling

type, title = request.key.split('/', 2)
return unless request.instance
unless type.casecmp(request.instance.type).zero? && title == request.instance.title
  raise Puppet::Indirector::ValidationError, 'key/type/title drift detected before save'
end

Type guard

def resource_matches_key?(resource, key)
  type, title = key.split('/', 2)
  type.casecmp(resource.type).zero? && title == resource.title
end

Prevention

Derive request keys from resource.ref ("#{type}/#{title}") instead of composing strings
Never mutate a resource's title between building the key and saving
Unit-test save paths with resources whose titles contain spaces/case to catch drift

When it happens

Trigger: Building a Puppet::Resource::Request (or calling Puppet::Resource.indirection.save) with key 'service/httpd' but an instance of type :service titled 'nginx', or 'File[/tmp/a]' saved under key 'file//tmp/b'; also mismatched title case ('Web01' vs 'web01') since title comparison is exact.

Common situations: Custom report/inspection tools that re-key resources (e.g., normalizing titles to lowercase) before saving; copy-paste of request construction where key and instance come from different sources; refactoring resource titles with capitalization changes while reusing cached keys.

Related errors

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/be0b8514fd2a702d. Report an issue: GitHub.