{"record":{"id":"0cf06b56c4783395","repo":"hashicorp/nomad","slug":"can-not-target-wildcard-namespace","errorCode":null,"errorMessage":"can not target wildcard (\"*\")namespace","messagePattern":"can not target wildcard \\(\"\\*\"\\)namespace","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/variables.go","lineNumber":74,"sourceCode":"\t// TTL on a lock.They come from the experience on Consul.\n\tminVariableLockTTL = 10 * time.Second\n\tmaxVariableLockTTL = 24 * time.Hour\n\n\t// defaultLockTTL is the default value used to maintain a lock before it needs to\n\t// be renewed. The actual value comes from the experience with Consul.\n\tdefaultLockTTL = 15 * time.Second\n\n\t// defaultLockDelay is the default a lock will be blocked after the TTL\n\t// went by without any renews. It is intended to prevent split brain situations.\n\t// The actual value comes from the experience with Consul.\n\tdefaultLockDelay = 15 * time.Second\n)\n\nvar (\n\terrNoPath             = errors.New(\"missing path\")\n\terrNoNamespace        = errors.New(\"missing namespace\")\n\terrNoLock             = errors.New(\"missing lock ID\")\n\terrWildCardNamespace  = errors.New(\"can not target wildcard (\\\"*\\\")namespace\")\n\terrQuotaExhausted     = errors.New(\"variables are limited to 64KiB in total size\")\n\terrNegativeDelayOrTTL = errors.New(\"Lock delay and TTL must be positive\")\n\terrInvalidTTL         = errors.New(\"TTL must be between 10 seconds and 24 hours\")\n)\n\n// VariableMetadata is the metadata envelope for a Variable, it is the list\n// object and is shared data between an VariableEncrypted and a\n// VariableDecrypted object.\ntype VariableMetadata struct {\n\tNamespace string\n\tPath      string\n\n\t// Lock represents a variable which is used for locking functionality.\n\tLock *VariableLock `json:\",omitempty\"`\n\n\tCreateIndex uint64\n\tCreateTime  int64\n\tModifyIndex uint64","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/variables.go#L56-L92","documentation":"errWildCardNamespace is the sentinel error \"can not target wildcard (\\\"*\\\")namespace\" in Nomad's structs package. ValidateForLock rejects any variable-decrypt request whose Namespace is AllNamespacesSentinel (\"*\"), because lock operations require targeting exactly one namespace; the wildcard is only meaningful for read-all queries.","triggerScenarios":"Calling ValidateForLock on a VariableDecrypted whose Namespace == \"*\" (AllNamespacesSentinel), e.g. lock/unlock requests issued with the wildcard namespace from a wildcard-capable read query.","commonSituations":"Reusing a list/query request (which allows namespace=\"*\") as the basis for a lock operation; CLI or API clients inheriting the wildcard namespace from a global -namespace '*' setting; attempting cross-namespace lock acquisition.","solutions":["Set the request's Namespace to a concrete namespace (e.g. \"default\") before performing the lock operation.","Derive the target namespace from the variable's own metadata instead of propagating the wildcard filter.","Change tooling defaults so lock operations never inherit a wildcard namespace scope."],"exampleFix":"// before\nvd.Namespace = structs.AllNamespacesSentinel // \"*\"\nValidateForLock(vd) // rejected\n// after\nvd.Namespace = \"default\"\nValidateForLock(vd)","handlingStrategy":"validation","validationCode":"if vd.Namespace == structs.AllNamespacesSentinel {\n\treturn errors.New(\"lock operations require a concrete namespace, not \\\"*\\\"\")\n}","typeGuard":"func lockableNamespace(ns string) bool { return ns != \"\" && ns != structs.AllNamespacesSentinel }","tryCatchPattern":"if errors.Is(err, structs.ErrWildCardNamespace) {\n\t// replace the wildcard namespace with a concrete one and retry\n}","preventionTips":["Never reuse wildcard-scoped list requests as lock operation inputs","Resolve the wildcard from query filters to a single namespace before locking","Avoid global `-namespace '*'` defaults in tooling that performs lock operations"],"tags":["nomad","variables","locking","namespaces","validation"],"backgroundTag":"wildcard-namespace-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}