{"record":{"id":"222084549f48451c","repo":"hashicorp/nomad","slug":"could-not-write-namespace-q-w","errorCode":null,"errorMessage":"[✘] Could not write namespace %q: %w","messagePattern":"\\[✘\\] Could not write namespace %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_consul.go","lineNumber":505,"sourceCode":"\n\texistingNamespaces, _, _ := nsClient.List(nil)\n\treturn slices.ContainsFunc(\n\t\texistingNamespaces,\n\t\tfunc(n *api.Namespace) bool { return n.Name == ns })\n}\n\nfunc (s *SetupConsulCommand) createNamespace(ns string) error {\n\tnsClient := s.client.Namespaces()\n\tnamespace := &api.Namespace{\n\t\tName: ns,\n\t\tMeta: map[string]string{\n\t\t\t\"created-by\": \"nomad-setup\",\n\t\t},\n\t}\n\n\t_, _, err := nsClient.Create(namespace, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not write namespace %q: %w\", ns, err)\n\t}\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created namespace %q.\", ns))\n\treturn nil\n}\n\nfunc (s *SetupConsulCommand) bindingRuleExists(rule *api.ACLBindingRule) bool {\n\tqo := &api.QueryOptions{}\n\tif s.consulEnt {\n\t\t// binding rules are created in the default ns\n\t\tqo.Namespace = \"default\"\n\t}\n\texistingRules, _, _ := s.client.ACL().BindingRuleList(\"\", qo)\n\treturn slices.ContainsFunc(\n\t\texistingRules,\n\t\tfunc(r *api.ACLBindingRule) bool {\n\t\t\treturn r.AuthMethod == rule.AuthMethod &&\n\t\t\t\tr.BindType == rule.BindType &&\n\t\t\t\tr.BindName == rule.BindName &&","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_consul.go#L487-L523","documentation":"createNamespace (Consul Enterprise only) creates a namespace via Consul's namespace API (nsClient.Create). Any API failure — connectivity, permissions, or the namespace feature being unavailable — is wrapped in this error. Namespaces are an Enterprise feature, so a common cause is attempting this against Consul OSS.","triggerScenarios":"`nomad setup consul -consul-ent` runs and nsClient.Create(namespace, nil) errors: Consul agent unreachable, token lacks namespace write permission, Consul is OSS (not Enterprise) so the namespace endpoint returns an error, or a namespace with the same name exists in an incompatible state.","commonSituations":"Running the setup against Consul OSS without realizing -consul-ent (or auto-detection) triggers namespace creation; CONSUL_HTTP_TOKEN lacking write access to namespaces; network/addr misconfiguration; Consul version older than the namespace API.","solutions":["Confirm you are running Consul Enterprise >= 1.7: `consul version`; drop the -consul-ent flag / use OSS-compatible setup if you're on OSS.","Verify the token can manage namespaces (`consul acl token read -self`; needs acl:write / namespace write) and export CONSUL_HTTP_TOKEN accordingly.","Check agent reachability: `consul members`, correct CONSUL_HTTP_ADDR; inspect the wrapped %v detail for the exact API error.","If the namespace already exists or conflicts, list namespaces (`consul namespace list`) and reconcile manually before re-running."],"exampleFix":"# before (OSS Consul)\nnomad setup consul -consul-ent\n// after (OSS)\nnomad setup consul   # without -consul-ent; namespace steps skipped","handlingStrategy":"try-catch","validationCode":"// pre-flight: confirm Enterprise and namespace permissions\nvers, _, err := s.client.Agent().Self()\nif err != nil { return err }\nif vers[\"Config\"][\"Enterprise\"] == \"\" {\n    return fmt.Errorf(\"namespaces require Consul Enterprise; running against OSS\")\n}\n_, _, err = s.client.Namespaces().List(nil)\nif err != nil { return fmt.Errorf(\"token cannot list namespaces: %v\", err) }","typeGuard":null,"tryCatchPattern":"_, _, err := nsClient.Create(namespace, nil)\nif err != nil {\n    if strings.Contains(err.Error(), \"Permission denied\") {\n        return fmt.Errorf(\"Consul token cannot create namespaces; use a token with acl:write: %w\", err)\n    }\n    return fmt.Errorf(\"[✘] Could not write namespace %q: %w\", ns, err)\n}","preventionTips":["Only use -consul-ent with Consul Enterprise (>=1.7); `consul version` to confirm.","Use a CONSUL_HTTP_TOKEN with acl:write / namespace management rights.","Verify agent reachability (consul members) before running setup.","Check the wrapped error detail in the output — it contains Consul's exact API rejection."],"tags":["consul","acl","enterprise","setup"],"backgroundTag":"consul-api-error","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}