{"record":{"id":"0dc6d60143c08f33","repo":"hashicorp/nomad","slug":"deleting-acl-policy-failed-v","errorCode":null,"errorMessage":"deleting acl policy failed: %v","messagePattern":"deleting acl policy failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/state/state_store.go","lineNumber":6293,"sourceCode":"\t}\n\n\t// Update the indexes tabl\n\tif err := txn.Insert(\"index\", &IndexEntry{\"acl_policy\", index}); err != nil {\n\t\treturn fmt.Errorf(\"index update failed: %v\", err)\n\t}\n\n\treturn txn.Commit()\n}\n\n// DeleteACLPolicies deletes the policies with the given names\nfunc (s *StateStore) DeleteACLPolicies(msgType structs.MessageType, index uint64, names []string) error {\n\ttxn := s.db.WriteTxnMsgT(msgType, index)\n\tdefer txn.Abort()\n\n\t// Delete the policy\n\tfor _, name := range names {\n\t\tif _, err := txn.DeleteAll(\"acl_policy\", \"id\", name); err != nil {\n\t\t\treturn fmt.Errorf(\"deleting acl policy failed: %v\", err)\n\t\t}\n\t}\n\tif err := txn.Insert(\"index\", &IndexEntry{\"acl_policy\", index}); err != nil {\n\t\treturn fmt.Errorf(\"index update failed: %v\", err)\n\t}\n\treturn txn.Commit()\n}\n\n// ACLPolicyByName is used to lookup a policy by name\nfunc (s *StateStore) ACLPolicyByName(ws memdb.WatchSet, name string) (*structs.ACLPolicy, error) {\n\ttxn := s.db.ReadTxn()\n\n\twatchCh, existing, err := txn.FirstWatch(\"acl_policy\", \"id\", name)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"acl policy lookup failed: %v\", err)\n\t}\n\tws.Add(watchCh)\n","sourceCodeStart":6275,"sourceCodeEnd":6311,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/state/state_store.go#L6275-L6311","documentation":"Thrown by DeleteACLPolicies when txn.DeleteAll(\"acl_policy\", \"id\", name) fails for one of the requested policy names. The delete of the policy row(s) failed inside memdb, so the transaction aborts and none of the named policies are removed.","triggerScenarios":"Client issues ACL policy deletion (API/CLI nomad acl policy delete, or batch delete) and the underlying memdb DeleteAll errors — internal store failure rather than 'policy not found' (missing policies simply delete zero rows).","commonSituations":"Deleting many policies in a batch against a degraded server; corrupted acl_policy table; memory exhaustion on the Nomad server.","solutions":["Retry the delete; the aborted transaction left state consistent","Delete policies one at a time to isolate a problematic name/table row","Check server logs for memdb errors and resource issues","Restore from snapshot if the acl_policy table appears corrupt"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Check the policy exists before deleting (optional; missing names do not error)\nconst list = await nomad.get('/v1/acl/policies');\nconst missing = names.filter(n => !list.some(p => p.Name === n));\nconsole.warn('not found (skipped):', missing);","typeGuard":null,"tryCatchPattern":"try {\n  await Promise.all(names.map(n => nomad.del(`/v1/acl/policy/${encodeURIComponent(n)}`)));\n} catch (e) {\n  if (String(e).includes('deleting acl policy failed')) return retryWithBackoff(deleteAll, names);\n  throw e;\n}","preventionTips":["Delete policies in smaller batches to reduce blast radius and ease retries","Retry is safe — the transaction aborts atomically","Check server logs/mem health if deletes repeatedly fail","Snapshot state before bulk ACL cleanup"],"tags":["nomad","acl","state-store","delete"],"backgroundTag":"acl-policy-delete-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}