{"record":{"id":"7a9a8fef73f58ecf","repo":"hashicorp/nomad","slug":"invalid-host-volume-capability-s-v","errorCode":null,"errorMessage":"Invalid host volume capability '%s': %#v","messagePattern":"Invalid host volume capability '(.+?)': %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":651,"sourceCode":"\t\tif np.Policy != \"\" {\n\t\t\textraCap := expandNodePoolPolicy(np.Policy)\n\t\t\tnp.Capabilities = append(np.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Remove the node-pool name from the extra key list.\n\t\tp.removeExtraKey(np.Name)\n\t}\n\n\tfor _, hv := range p.HostVolumes {\n\t\tif !validVolume.MatchString(hv.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid host volume name: %#v\", hv)\n\t\t}\n\t\tif hv.Policy != \"\" && !isPolicyValid(hv.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid host volume policy: %#v\", hv)\n\t\t}\n\t\tfor _, cap := range hv.Capabilities {\n\t\t\tif !isHostVolumeCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid host volume capability '%s': %#v\", cap, hv)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif hv.Policy != \"\" {\n\t\t\textraCap := expandHostVolumePolicy(hv.Policy)\n\t\t\thv.Capabilities = append(hv.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Remove the host-volume name from the extra key list.\n\t\tp.removeExtraKey(hv.Name)\n\t}\n\n\t// Now that we have processed all known keys, return an error if the\n\t// operator wrote a policy with unknown keys if we are being strict. While\n\t// these do not grant any extra privileges, it can be misleaing to allow\n\t// these and cause problems later if we add new capabilities that collide","sourceCodeStart":633,"sourceCodeEnd":669,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L633-L669","documentation":"acl.Parse() (acl/policy.go:651) validates each entry of a host_volume block's Capabilities list with isHostVolumeCapabilityValid, which only accepts \"deny\", \"mount-readonly\", and \"mount-readwrite\". Any other capability string fails parsing and the policy is rejected with the whole HostVolumePolicy printed via %#v.","triggerScenarios":"acl.Parse on a policy where a host_volume block's capabilities array contains an unrecognized string, e.g. capabilities = [\"read\"], [\"mount\"], or a namespace-style capability like \"list-jobs\".","commonSituations":"Confusing host-volume capabilities with namespace capabilities (e.g. 'host-volume-read'); inventing values like 'mount-ro'; version drift — older Nomad versions had no host_volume capabilities and a policy generated for a newer feature set uses unsupported entries.","solutions":["Replace the invalid capability with one of: deny, mount-readonly, mount-readwrite.","Alternatively drop capabilities entirely and use the shorthand policy = \"read\"|\"write\"|\"deny\", which expands to the right capabilities.","Read the '%s' in the error message to see exactly which capability string was rejected and fix that entry in the identified block."],"exampleFix":"// before\nhost_volume \"data\" {\n  capabilities = [\"mount\", \"read\"]\n}\n// after\nhost_volume \"data\" {\n  capabilities = [\"mount-readonly\"]\n}","handlingStrategy":"validation","validationCode":"var validHostVolCaps = map[string]bool{\"deny\": true, \"mount-readonly\": true, \"mount-readwrite\": true}\nfor _, hv := range policy.HostVolumes {\n    for _, c := range hv.Capabilities {\n        if !validHostVolCaps[c] {\n            return fmt.Errorf(\"host_volume %q: invalid capability %q\", hv.Name, c)\n        }\n    }\n}","typeGuard":"func isHostVolumeCapabilityValid(cap string) bool {\n    switch cap {\n    case \"deny\", \"mount-readonly\", \"mount-readwrite\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"_, err := acl.Parse(rules, acl.PolicyParseStrict)\nif err != nil {\n    if strings.Contains(err.Error(), \"Invalid host volume capability\") {\n        // extract the quoted capability from the message and fix that entry\n    }\n    return err\n}","preventionTips":["Only use deny, mount-readonly, mount-readwrite in host_volume capabilities","Do not reuse namespace or CSI capability names in host_volume blocks","Prefer the shorthand policy field unless you specifically need mount granularity"],"tags":["nomad","acl","capability-validation","host-volume"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}