{"record":{"id":"0f02ff4045bbcf90","repo":"hashicorp/nomad","slug":"errconnectinvalidnetworkmode","errorCode":"ErrConnectInvalidNetworkMode","errorMessage":"invalid network mode for Consul Connect","messagePattern":"invalid network mode for Consul Connect","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hook_connect.go","lineNumber":29,"sourceCode":"\t\"strings\"\n\t\"time\"\n\n\t\"github.com/hashicorp/go-set/v3\"\n\t\"github.com/hashicorp/nomad/client/taskenv\"\n\t\"github.com/hashicorp/nomad/helper/envoy\"\n\t\"github.com/hashicorp/nomad/helper/uuid\"\n\t\"github.com/hashicorp/nomad/nomad/structs\"\n)\n\nconst (\n\t// defaultConnectTimeout is the default amount of time a connect gateway will\n\t// wait for a response from an upstream service (same as consul)\n\tdefaultConnectTimeout = 5 * time.Second\n)\n\nvar (\n\tErrConnectRequireOneNetwork  = errors.New(\"must have exactly one network for Consul Connect\")\n\tErrConnectInvalidNetworkMode = errors.New(\"invalid network mode for Consul Connect\")\n)\n\n// connectSidecarResources returns the set of resources used by default for\n// the Consul Connect sidecar task\nfunc connectSidecarResources() *structs.Resources {\n\treturn &structs.Resources{\n\t\tCPU:      250,\n\t\tMemoryMB: 128,\n\t}\n}\n\n// connectSidecarDriverConfig is the driver configuration used by the injected\n// connect proxy sidecar task.\n//\n// Note: must be compatible with both docker and podman. One could imagine passing\n// in the driver name in the future and switching on that if we need specific\n// configs.\nfunc connectSidecarDriverConfig() map[string]any {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hook_connect.go#L11-L47","documentation":"When a task group uses Consul Connect, its single network must use a mode compatible with Connect (bridge for sidecars, or host for host-mode services/gateways). Nomad rejects the job if the declared network mode is not one of the allowed values.","triggerScenarios":"Submitting a connect-enabled group whose single network block has a `mode` value outside the allowed set (e.g. mode = \"none\", or a host network on a sidecar that requires bridge).","commonSituations":"Setting network mode = \"host\" for a sidecar proxy that needs bridge; typo in mode string; copying a non-connect group's network config into a connect group.","solutions":["Set the group network mode to \"bridge\" for Connect sidecars (or \"host\" where host networking is required, e.g. with transparent proxy setups).","Check the allowed modes listed in the full error message and match one exactly.","Remove the explicit network mode to let Nomad apply the Connect default."],"exampleFix":"// before\nnetwork {\n  mode = \"none\"\n}\nconnect { sidecar_service {} }\n\n// after\nnetwork {\n  mode = \"bridge\"\n}\nconnect { sidecar_service {} }","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"bridge\": true, \"host\": true}\nif group.Connect != nil && (len(group.Networks) != 1 || !allowed[group.Networks[0].Mode]) {\n  return fmt.Errorf(\"group %q: connect network mode %q not allowed\", group.Name, group.Networks[0].Mode)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always declare network mode explicitly on connect groups","Match the mode suggested by the full error message's allowed list","Consult Nomad docs for mode requirements per gateway kind"],"tags":["nomad","consul-connect","network-mode","job-validation"],"backgroundTag":"consul-connect-network-validation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}