{"record":{"id":"41644fde62b2b563","repo":"hashicorp/nomad","slug":"could-not-create-consul-policy-w","errorCode":null,"errorMessage":"[✘] Could not create Consul policy: %w","messagePattern":"\\[✘\\] Could not create Consul policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_consul.go","lineNumber":578,"sourceCode":"\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created role %q.\", consulRoleTasks))\n\treturn nil\n}\n\nfunc (s *SetupConsulCommand) policyExists() bool {\n\texistingPolicies, _, _ := s.client.ACL().PolicyList(nil)\n\treturn slices.ContainsFunc(\n\t\texistingPolicies,\n\t\tfunc(p *api.ACLPolicyListEntry) bool { return p.Name == consulPolicyName })\n}\n\nfunc (s *SetupConsulCommand) createPolicy() error {\n\t_, _, err := s.client.ACL().PolicyCreate(&api.ACLPolicy{\n\t\tName:  consulPolicyName,\n\t\tRules: string(consulPolicyBody),\n\t}, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not create Consul policy: %w\", err)\n\t}\n\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created policy %q.\", consulPolicyName))\n\n\treturn nil\n}\n\nfunc (s *SetupConsulCommand) handleNo() {\n\ts.Ui.Warn(`\nBy answering \"no\" to any of these questions, you are risking an incorrect Consul\ncluster configuration. Nomad workloads with Workload Identity will not be able\nto authenticate unless you create missing configuration yourself.\n`)\n\n\texitCode := 0\n\tif s.autoYes || s.askQuestion(\"Remove everything this command creates? [Y/n]\") {\n\t\texitCode = s.removeConfiguredComponents()\n\t}","sourceCodeStart":560,"sourceCodeEnd":596,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_consul.go#L560-L596","documentation":"createPolicy creates the 'nomad-workloads' Consul ACL policy (node/service/event-stream rules) via ACL().PolicyCreate. Any API error — connectivity, insufficient token privileges, or malformed policy rules — is wrapped here.","triggerScenarios":"`nomad setup consul` calls PolicyCreate and errors: Consul agent unreachable, the token lacks acl:write (policy creation requires management-level privileges or acl:write on policies), the ACL system is not enabled in Consul, or the compiled-in policy rules are rejected by the Consul version in use.","commonSituations":"CONSUL_HTTP_TOKEN absent or read-only; ACLs not bootstrapped/enabled on the Consul cluster; old Consul version not recognizing newer policy syntax (e.g. service identities or event streaming rules); wrong CONSUL_HTTP_ADDR pointing at an unreachable agent.","solutions":["Export a token with acl:write (management token) and retry: `export CONSUL_HTTP_TOKEN=<token>`; check with `consul acl token read -self`.","Ensure ACLs are enabled: check `acl.enabled` in the Consul agent config or `consul acl bootstrap` if never bootstrapped.","Verify connectivity (`consul members`, CONSUL_HTTP_ADDR) and read the wrapped underlying error to see Consul's exact rejection.","If the policy already exists from an earlier run, that's expected (setup skips it); otherwise update it manually via `consul acl policy update -name nomad-workloads` if rules are rejected."],"exampleFix":"# before\nnomad setup consul   # ACLs disabled on server\n// after\n# enable in Consul server config: \"acl\": { \"enabled\": true, \"default_policy\": \"deny\" }\nconsul acl bootstrap            # get management token\nexport CONSUL_HTTP_TOKEN=<secret-id>\nnomad setup consul","handlingStrategy":"try-catch","validationCode":"// pre-flight: ACLs enabled and token can write\ninfo, err := s.client.Agent().Self()\nif err != nil { return err }\nif cfg, ok := info[\"DebugConfig\"]; ok && cfg[\"ACLDatacenter\"] == \"\" /* or acl.enabled false */ {\n    return fmt.Errorf(\"Consul ACLs are not enabled; enable acl.enabled and bootstrap first\")\n}\n_, _, err = s.client.ACL().PolicyList(nil)\nif err != nil { return fmt.Errorf(\"token cannot list policies (missing/insufficient CONSUL_HTTP_TOKEN?): %v\", err) }","typeGuard":null,"tryCatchPattern":"_, _, err := s.client.ACL().PolicyCreate(policy, nil)\nif err != nil {\n    if strings.Contains(err.Error(), \"Permission denied\") {\n        return fmt.Errorf(\"use a management/acl:write token in CONSUL_HTTP_TOKEN: %w\", err)\n    }\n    if strings.Contains(err.Error(), \"ACL not enabled\") {\n        return fmt.Errorf(\"enable ACLs in Consul config and run 'consul acl bootstrap': %w\", err)\n    }\n    return fmt.Errorf(\"[✘] Could not create Consul policy: %w\", err)\n}","preventionTips":["Enable and bootstrap Consul ACLs before running nomad setup (acl.enabled=true, consul acl bootstrap).","Always run setup with CONSUL_HTTP_TOKEN set to a management or sufficiently privileged token.","Check Consul version compatibility with the compiled-in policy rules (older clusters may reject newer syntax).","Verify agent reachability with `consul members` and correct CONSUL_HTTP_ADDR.","If the policy already exists, that's normal — setup is idempotent; don't delete it mid-run."],"tags":["consul","acl","setup"],"backgroundTag":"consul-api-error","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}