{"record":{"id":"03db902de4305d18","repo":"hashicorp/nomad","slug":"errconnectrequireonenetwork","errorCode":"ErrConnectRequireOneNetwork","errorMessage":"must have exactly one network for Consul Connect","messagePattern":"must have exactly one network for Consul Connect","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hook_connect.go","lineNumber":28,"sourceCode":"\t\"strconv\"\n\t\"strings\"\n\t\"time\"\n\n\t\"github.com/hashicorp/go-set/v3\"\n\t\"github.com/hashicorp/nomad/client/taskenv\"\n\t\"github.com/hashicorp/nomad/helper/envoy\"\n\t\"github.com/hashicorp/nomad/helper/uuid\"\n\t\"github.com/hashicorp/nomad/nomad/structs\"\n)\n\nconst (\n\t// defaultConnectTimeout is the default amount of time a connect gateway will\n\t// wait for a response from an upstream service (same as consul)\n\tdefaultConnectTimeout = 5 * time.Second\n)\n\nvar (\n\tErrConnectRequireOneNetwork  = errors.New(\"must have exactly one network for Consul Connect\")\n\tErrConnectInvalidNetworkMode = errors.New(\"invalid network mode for Consul Connect\")\n)\n\n// connectSidecarResources returns the set of resources used by default for\n// the Consul Connect sidecar task\nfunc connectSidecarResources() *structs.Resources {\n\treturn &structs.Resources{\n\t\tCPU:      250,\n\t\tMemoryMB: 128,\n\t}\n}\n\n// connectSidecarDriverConfig is the driver configuration used by the injected\n// connect proxy sidecar task.\n//\n// Note: must be compatible with both docker and podman. One could imagine passing\n// in the driver name in the future and switching on that if we need specific\n// configs.","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hook_connect.go#L10-L46","documentation":"Nomad's Consul Connect integration requires each task group with a connect block to declare exactly one network stanza. The job submission endpoint returns this error wrapped with the group name and the offending network count when that invariant is violated.","triggerScenarios":"Submitting a job whose task group has a `connect { sidecar_service ... }` (or gateway) block while `group.Networks` has length != 1 (0 networks, or 2+ networks). Validation runs in groupConnectNetworkModeValidate via the job mutate/validate hook.","commonSituations":"Adding a connect service to a group that previously had no network block; accidentally specifying two network stanzas (e.g. bridge + host) on a connect-enabled group; copy-pasting network config from another group.","solutions":["Ensure the connect-enabled task group declares exactly one network block (typically `network { mode = \"bridge\" }`).","Remove extra network stanzas so only one remains in the group.","If a connect service port is needed, use the existing single network's port/dynamic port rather than adding a second network."],"exampleFix":"// before\ngroup \"api\" {\n  network {\n    mode = \"bridge\"\n  }\n  network {\n    mode = \"host\"\n  }\n  connect { sidecar_service {} }\n}\n\n// after\ngroup \"api\" {\n  network {\n    mode = \"bridge\"\n  }\n  connect { sidecar_service {} }\n}","handlingStrategy":"validation","validationCode":"// HCL/Job check before submit\nif group.Connect != nil && len(group.Networks) != 1 {\n  return fmt.Errorf(\"group %q: connect requires exactly one network, has %d\", group.Name, len(group.Networks))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Give every connect-enabled group exactly one network block","Use mode = \"bridge\" for sidecar-based connect services","Validate jobs with `nomad job validate` before submitting"],"tags":["nomad","consul-connect","job-validation","network"],"backgroundTag":"consul-connect-network-validation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}