{"record":{"id":"079311e2e4d2be11","repo":"hashicorp/nomad","slug":"acl-auth-method-lookup-failed-v-079311","errorCode":null,"errorMessage":"ACL auth method lookup failed: %v","messagePattern":"ACL auth method lookup failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/state/state_store_acl_sso.go","lineNumber":80,"sourceCode":"\t\tmethod.SetHash()\n\t}\n\n\t// This validation also happens within the RPC handler, but Raft latency\n\t// could mean that by the time the state call is invoked, another Raft\n\t// update has already written a method with the same name or default\n\t// setting. We therefore need to check we are not trying to create a method\n\t// with an existing name or a duplicate default for the same type.\n\tif method.Default {\n\t\texistingMethodsDefaultMethod, _ := s.GetDefaultACLAuthMethod(nil)\n\t\tif existingMethodsDefaultMethod != nil && existingMethodsDefaultMethod.Name != method.Name {\n\t\t\treturn false, fmt.Errorf(\n\t\t\t\t\"default ACL auth method already exists: %v\", existingMethodsDefaultMethod.Name,\n\t\t\t)\n\t\t}\n\t}\n\texistingRaw, err := txn.First(TableACLAuthMethods, indexID, method.Name)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"ACL auth method lookup failed: %v\", err)\n\t}\n\n\tvar existing *structs.ACLAuthMethod\n\tif existingRaw != nil {\n\t\texisting = existingRaw.(*structs.ACLAuthMethod)\n\t}\n\n\t// Depending on whether this is an initial create, or an update, we need to\n\t// check and set certain parameters. The most important is to ensure any\n\t// create index is carried over.\n\tif existing != nil {\n\n\t\t// If the method already exists, check whether the update contains any\n\t\t// difference. If it doesn't, we can avoid a state update as well as\n\t\t// updates to any blocking queries.\n\t\tif existing.Equal(method) {\n\t\t\treturn false, nil\n\t\t}","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/state/state_store_acl_sso.go#L62-L98","documentation":"During upsertACLAuthMethodTxn, the store checks whether an auth method with the same name already exists via txn.First(TableACLAuthMethods, \"id\", method.Name). This error wraps a failure of that existence-check read itself. It aborts the upsert before any insert or update happens.","triggerScenarios":"Calling UpsertACLAuthMethods where the duplicate-name existence probe txn.First(TableACLAuthMethods, indexID, method.Name) returns an error rather than a row or nil.","commonSituations":"Memdb table/index inconsistency after a corrupted restore; version skew changing the auth-method table's 'id' index; transient read failures during leader failover.","solutions":["Retry the upsert; errors during leader election are typically transient.","Inspect the wrapped cause; restore the state store from a verified snapshot if corruption is indicated.","Restart the Nomad server to rebuild memdb from Raft logs.","Ensure all servers run the same Nomad version so table index definitions match."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"existing, err := state.GetACLAuthMethodByName(nil, method.Name)\nif err != nil {\n    return retryableError(err)\n} // nil existing means name is free; proceed with upsert","typeGuard":null,"tryCatchPattern":"if err := upsertAuthMethod(m); err != nil {\n    if strings.Contains(err.Error(), \"ACL auth method lookup failed\") {\n        return retryWithBackoff(func() error { return upsertAuthMethod(m) })\n    }\n    return err\n}","preventionTips":["Retry upserts during leader failover — the read probe can fail transiently.","Verify auth method names are well-formed before upserting.","Restore from snapshot if the wrapped memdb error persists across retries.","Avoid mixed Nomad versions that alter the auth-method table indexes."],"tags":["nomad","state-store","acl","lookup"],"backgroundTag":"state-store-transaction-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}