{"record":{"id":"76c08d1026ad6dc7","repo":"hashicorp/nomad","slug":"invalid-plugin-policy-v","errorCode":null,"errorMessage":"Invalid plugin policy: %#v","messagePattern":"Invalid plugin policy: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":727,"sourceCode":"\t\t\tif !isSentinelCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid sentinel capability '%s'\", cap)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif p.Sentinel.Policy != \"\" {\n\t\t\textraCap := expandSentinelPolicy(p.Sentinel.Policy)\n\t\t\tp.Sentinel.Capabilities = append(p.Sentinel.Capabilities, extraCap...)\n\t\t}\n\t}\n\n\tif p.Quota != nil && !isPolicyValid(p.Quota.Policy) {\n\t\treturn nil, fmt.Errorf(\"Invalid quota policy: %#v\", p.Quota)\n\t}\n\n\tif p.Plugin != nil && !p.Plugin.isValid() {\n\t\treturn nil, fmt.Errorf(\"Invalid plugin policy: %#v\", p.Plugin)\n\t}\n\treturn p, nil\n}\n\n// hclDecode wraps hcl.Decode function but handles any unexpected panics\nfunc hclDecode(p *Policy, rules string) (err error) {\n\tdefer func() {\n\t\tif rerr := recover(); rerr != nil {\n\t\t\terr = fmt.Errorf(\"invalid acl policy: %v\", rerr)\n\t\t}\n\t}()\n\n\tif err = hcl.Decode(p, rules); err != nil {\n\t\treturn err\n\t}\n\n\t// Manually parse the policy to fix blocks without labels.\n\t//","sourceCodeStart":709,"sourceCodeEnd":745,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L709-L745","documentation":"This error is returned by acl/policy.go when a parsed ACL policy contains a `plugin` stanza that fails `p.Plugin.isValid()`. The plugin policy struct (PluginPolicy) is validated after HCL decoding, and an invalid one rejects the entire Policy. The %#v formatting dumps the Plugin struct for diagnosis.","triggerScenarios":"Parsing ACL policy rules containing a `plugin { ... }` stanza whose fields (e.g. name/sharding rules) do not pass PluginPolicy.isValid — such as a missing or empty required field.","commonSituations":"Enterprising users writing plugin ACL policies by hand; truncated templated policy files; upgrading from versions with different PluginPolicy requirements.","solutions":["Correct the fields in the `plugin` stanza so PluginPolicy.isValid passes (required name and shard config present).","Remove the `plugin` stanza if plugin-level ACL restriction is not used.","Compare against a known-good example of plugin policy syntax from the Consul documentation."],"exampleFix":"// before\nplugin {\n  name = \"\"\n}\n// after\nplugin {\n  name = \"my-plugin\"\n  shard = \"us-east-1\"\n}","handlingStrategy":"validation","validationCode":"// ensure plugin stanza has required fields before parse\nif strings.Contains(rules, \"plugin {\") {\n    if !regexp.MustCompile(`plugin\\s*{\\s*name\\s*=\\s*\"[^\"]+\"`).MatchString(rules) {\n        return fmt.Errorf(\"plugin stanza requires a non-empty name\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep plugin policy snippets sourced from the same Consul version docs you run.","Lint policy files in CI before deploying.","Avoid hand-editing plugin stanzas in production policies."],"tags":["acl","policy-validation","hcl","consul"],"backgroundTag":"policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}