{"record":{"id":"1b355262a249b684","repo":"hashicorp/nomad","slug":"service-with-provider-nomad-cannot-include-connect","errorCode":null,"errorMessage":"Service with provider nomad cannot include Connect blocks","messagePattern":"Service with provider nomad cannot include Connect blocks","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":924,"sourceCode":"// nomad provider.\nfunc (s *Service) validateNomadService(mErr *multierror.Error) {\n\t// check checks\n\tfor _, c := range s.Checks {\n\t\t// validate the check port\n\t\tif err := s.validateCheckPort(c); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\tcontinue\n\t\t}\n\n\t\t// validate the nomad check\n\t\tif err := c.validateNomad(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t}\n\n\t// Services using the Nomad provider do not support Consul connect.\n\tif s.Connect != nil {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Service with provider nomad cannot include Connect blocks\"))\n\t}\n}\n\n// validateIdentity performs validation on workload identity field populated by\n// the job mutating hook\nfunc (s *Service) validateIdentity() error {\n\tif s.Identity == nil {\n\t\treturn nil\n\t}\n\n\tif len(s.Identity.Audience) == 0 {\n\t\treturn fmt.Errorf(\"Service identity must provide at least one target aud value\")\n\t}\n\n\treturn nil\n}\n\n// ValidateName checks if the service Name is valid and should be called after","sourceCodeStart":906,"sourceCodeEnd":942,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L906-L942","documentation":"validateNomadService checks each service whose provider is \"nomad\" and rejects any Connect block. Consul Connect (service mesh) features are only implemented through the Consul provider; native Nomad services cannot carry connect stanza definitions.","triggerScenarios":"Submitting a job where a service has provider = \"nomad\" and a non-nil connect block (e.g. connect { sidecar_service {} } or a connect gateway stanza), during Validate.","commonSituations":"Migrating mesh-enabled services from Consul to Nomad provider without removing the connect stanza; job templates with connect sidecars that got their provider switched to nomad.","solutions":["Remove the connect block from the service, or change the service provider back to \"consul\"","If mesh is not required, delete connect/sidecar stanzas and expose blocks tied to Connect","Use Nomad's native service discovery without Connect, or keep Consul for mesh-dependent services"],"exampleFix":"// before\nservice {\n  name     = \"web\"\n  provider = \"nomad\"\n  connect { sidecar_service {} }\n}\n// after\nservice {\n  name     = \"web\"\n  provider = \"nomad\"\n}","handlingStrategy":"validation","validationCode":"function validateNoConnectWithNomadProvider(services) {\n  for (const s of services ?? []) {\n    if ((s.provider ?? \"consul\") === \"nomad\" && s.connect) {\n      throw new Error(`service ${s.name}: connect blocks require provider consul`);\n    }\n  }\n}","typeGuard":"function supportsConnect(s) { return (s.provider ?? \"consul\") === \"consul\"; }","tryCatchPattern":"try {\n  await nomad.jobs.validate(job);\n} catch (e) {\n  if (e.message.includes(\"cannot include Connect blocks\")) {\n    console.error(\"Drop the connect stanza or revert provider to consul\");\n  } else throw e;\n}","preventionTips":["Decide per-service whether it needs mesh; only mesh services should use consul provider + connect","Lint job files for provider/connect combinations","Document that nomad provider has no Connect support"],"tags":["nomad","consul","connect","service-mesh","job-validation"],"backgroundTag":"unsupported-provider-option","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}