{"record":{"id":"08419e0c4939ae77","repo":"hashicorp/nomad","slug":"file-system-access-type-was-not-requested-but-wa","errorCode":null,"errorMessage":"'file-system' access type was not requested but was validated by the controller","messagePattern":"'file-system' access type was not requested but was validated by the controller","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/csi/client.go","lineNumber":599,"sourceCode":"\t\t}\n\n\t\tcapBlock := cap.GetBlock()\n\t\tcapMount := cap.GetMount()\n\t\texpectedBlock := expected.GetBlock()\n\t\texpectedMount := expected.GetMount()\n\n\t\tif capBlock != nil && expectedBlock == nil {\n\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\"'block-device' access type was not requested but was validated by the controller\"))\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tif capMount == nil {\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tif expectedMount == nil {\n\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\"'file-system' access type was not requested but was validated by the controller\"))\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tif expectedMount.FsType != capMount.FsType {\n\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\"requested filesystem type %v, got %v\",\n\t\t\t\texpectedMount.FsType, capMount.FsType))\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tfor _, expectedFlag := range expectedMount.MountFlags {\n\n\t\t\t// The mount flags can contain sensitive data, so we can't log exact\n\t\t\t// details.\n\t\t\tif !slices.Contains(capMount.MountFlags, expectedFlag) {\n\t\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\t\"requested mount flags did not match available capabilities\"))","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/plugins/csi/client.go#L581-L617","documentation":"In compareCapabilities, if the plugin validated a capability with a 'mount' (file-system) access type but the caller did not request a mount capability, Nomad appends this error. Like the block-device variant, it means the plugin validated capabilities outside the requested set, so validation results cannot be trusted as a match.","triggerScenarios":"ControllerValidateCapabilities called with only block-device capabilities requested, but the plugin response includes a capability where GetMount() is non-nil, hitting expectedMount == nil after the capMount nil check.","commonSituations":"Registering a raw-block volume but the plugin (possibly misconfigured or buggy) validates filesystem capabilities too; plugin upgrade changed validation to be non-strict; mixing volume spec templates across drivers that behave differently.","solutions":["Add a mount/file-system capability to the request if filesystem usage is intended","Verify with the plugin vendor that ControllerValidateVolumeCapabilities should only echo requested capabilities; upgrade/patch the plugin if it over-validates","Re-register the volume with the correct access_type matching actual usage","Re-run validation after the fix"],"exampleFix":"// before: only block-device requested\nvolume_capabilities = [{ access_type = \"block-device\", access_mode = \"single-node-writer\" }]\n// after: request the mount capability explicitly if using a filesystem\nvolume_capabilities = [{ access_type = \"mount\", access_mode = \"single-node-writer\", fs_type = \"ext4\" }]","handlingStrategy":"validation","validationCode":"// ensure a mount capability is present in the request when the volume uses a filesystem\nhasMount := false\nfor _, cap := range req.VolumeCapabilities {\n    if cap.GetMount() != nil { hasMount = true }\n}\nif !hasMount {\n    return errors.New(\"volume uses a filesystem but no mount capability was requested\")\n}","typeGuard":"func onlyRequestedTypesValidated(expected, validated []*csipbv1.VolumeCapability) error {\n    for _, v := range validated {\n        if v.GetMount() != nil {\n            found := false\n            for _, e := range expected {\n                if e.GetMount() != nil { found = true }\n            }\n            if !found { return errors.New(\"file-system validated but not requested\") }\n        }\n    }\n    return nil\n}","tryCatchPattern":"err := client.ControllerValidateCapabilities(ctx, req)\nif err != nil {\n    if strings.Contains(err.Error(), \"'file-system' access type was not requested\") {\n        // add a mount capability to the request or fix the plugin\n    }\n    return err\n}","preventionTips":["Declare access_type = \"mount\" whenever the consumer will mount a filesystem","Do not reuse raw-block volume specs for filesystem-backed volumes","Verify plugin strictness: it should only validate requested capabilities; upgrade otherwise","Re-register the volume when changing access types and re-run validation"],"tags":["csi","file-system","validation","access-type"],"backgroundTag":"csi-capability-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}