{"record":{"id":"1cdad52215b2c5e1","repo":"hashicorp/nomad","slug":"used-group-network-mode-q-is-not-allowed-in-names","errorCode":null,"errorMessage":"used group network mode %q is not allowed in namespace %q","messagePattern":"used group network mode %q is not allowed in namespace %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_validators.go","lineNumber":62,"sourceCode":"\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used task drivers %q are not allowed in namespace %q\", disallowedDrivers, ns.Name,\n\t\t\t)\n\t\t}\n\t}\n\n\tvar disallowedNetworkModes []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, network := range tg.Networks {\n\t\t\tif allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {\n\t\t\t\tdisallowedNetworkModes = append(disallowedNetworkModes, network_mode)\n\t\t\t}\n\t\t}\n\t}\n\tif len(disallowedNetworkModes) > 0 {\n\t\tif len(disallowedNetworkModes) == 1 {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used group network mode %q is not allowed in namespace %q\", disallowedNetworkModes[0], ns.Name,\n\t\t\t)\n\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used group network modes %q are not allowed in namespace %q\", disallowedNetworkModes, ns.Name,\n\t\t\t)\n\t\t}\n\t}\n\n\treturn nil, nil\n}\n\nfunc taskValidateNetworkMode(network *structs.NetworkResource, ns *structs.Namespace) (bool, string) {\n\tnetwork_mode := \"host\"\n\tif len(network.Mode) > 0 {\n\t\tnetwork_mode = network.Mode\n\t}","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_validators.go#L44-L80","documentation":"Namespaces can also restrict group network modes (namespace network allow/deny lists). This validator collects each task group's network mode that is disallowed; when exactly one is found, registration fails with this singular error naming the network mode and namespace.","triggerScenarios":"Registering a job where exactly one group network mode (e.g. \"bridge\", \"host\", \"cni/foo\") is not permitted by the namespace's network policy. Raised in Validate when len(disallowedNetworkModes) == 1.","commonSituations":"namespace restricted to bridge networking but a job uses host networking; CNI-based modes blocked in a namespace on clusters without CNI configured; service-mesh (consul connect, mode=bridge) jobs deployed into namespaces disallowing bridge.","solutions":["Change the group network block's mode to one allowed by the namespace","Update the namespace network policy (nomad namespace apply -allow-network/-deny-network)","Move the job to a namespace permitting the required network mode"],"exampleFix":"// before\nnetwork { mode = \"host\" } // namespace allows only bridge\n// after\nnetwork { mode = \"bridge\" }\n// or: nomad namespace apply -allow-network=host team","handlingStrategy":"validation","validationCode":"// before submit\nns, _ := client.Namespaces().Info(job.Namespace, nil)\nfor _, tg := range job.TaskGroups {\n  for _, n := range tg.Networks {\n    if !networkModeAllowedInNamespace(ns, n.Mode) {\n      return fmt.Errorf(\"network mode %s not allowed in %s\", n.Mode, ns.Name)\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm namespace network policy before choosing bridge/host/cni modes","Lint network blocks against namespace allow-lists in CI","Remember service mesh jobs typically need bridge mode allowed"],"tags":["nomad","namespace","network-mode","job-validation"],"backgroundTag":"network-mode-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}