{"record":{"id":"0a4dddc0e4d1e95b","repo":"hashicorp/nomad","slug":"can-not-delete-default-namespace","errorCode":null,"errorMessage":"can not delete default namespace","messagePattern":"can not delete default namespace","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/namespace_endpoint.go","lineNumber":112,"sourceCode":"\tif authErr != nil {\n\t\treturn structs.ErrPermissionDenied\n\t}\n\tdefer metrics.MeasureSince([]string{\"nomad\", \"namespace\", \"delete_namespaces\"}, time.Now())\n\n\t// Check management permissions\n\tif aclObj, err := n.srv.ResolveACL(args); err != nil {\n\t\treturn err\n\t} else if !aclObj.IsManagement() {\n\t\treturn structs.ErrPermissionDenied\n\t}\n\n\t// Validate at least one namespace\n\tif len(args.Namespaces) == 0 {\n\t\treturn fmt.Errorf(\"must specify at least one namespace to delete\")\n\t}\n\n\tif slices.Contains(args.Namespaces, structs.DefaultNamespace) {\n\t\treturn fmt.Errorf(\"can not delete default namespace\")\n\t}\n\n\t// snapshot the state once, because we'll be doing many checks and want\n\t// consistend state\n\tsnap, err := n.srv.fsm.State().Snapshot()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar mErr multierror.Error\n\tfor _, ns := range args.Namespaces {\n\t\t// make sure this namespace exists before we start making costly checks\n\t\texists, _ := snap.NamespaceByName(nil, ns)\n\t\tif exists == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\t// do a check across jobs, allocations, volumes and variables to make sure we're","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/namespace_endpoint.go#L94-L130","documentation":"DeleteNamespaces refuses to delete the built-in 'default' namespace (structs.DefaultNamespace). The default namespace is a system sentinel that jobs, ACLs, and API defaults rely on, so deleting it would break cluster invariants. The check runs before any state mutation.","triggerScenarios":"Including \"default\" in the Namespaces slice of a NamespaceDeleteRequest, e.g. deleting all namespaces from a wildcard listing without filtering out 'default'.","commonSituations":"Bulk cleanup scripts that enumerate and delete all namespaces; operators trying to 'reset' a cluster; tests reusing a wildcard delete helper.","solutions":["Remove \"default\" from the Namespaces list before calling Delete.","Filter with slices.DeleteFunc(names, func(n string) bool { return n == \"default\" }).","Migrate workloads to another namespace instead of trying to delete default."],"exampleFix":"// before\nclient.Namespaces().Delete(&api.NamespaceDeleteRequest{Namespaces: allNames})\n// after\nnames := slices.DeleteFunc(allNames, func(n string) bool { return n == structs.DefaultNamespace })\nclient.Namespaces().Delete(&api.NamespaceDeleteRequest{Namespaces: names})","handlingStrategy":"validation","validationCode":"names := slices.DeleteFunc(names, func(n string) bool { return n == \"default\" })\nif len(names) == 0 { return nil }\n_, err := client.Namespaces().Delete(&api.NamespaceDeleteRequest{Namespaces: names})","typeGuard":"func deletableNamespaces(names []string) []string {\n    out := make([]string, 0, len(names))\n    for _, n := range names { if n != \"default\" { out = append(out, n) } }\n    return out\n}","tryCatchPattern":null,"preventionTips":["Never include built-in namespaces in bulk deletes.","Filter wildcard listings before deleting.","Centralize namespace cleanup in one helper that excludes reserved names."],"tags":["nomad","namespace-delete","protected-resource"],"backgroundTag":"protected-resource-delete","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}