{"record":{"id":"87b21db907321641","repo":"hashicorp/nomad","slug":"requested-mount-flags-did-not-match-available-capa","errorCode":null,"errorMessage":"requested mount flags did not match available capabilities","messagePattern":"requested mount flags did not match available capabilities","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/csi/client.go","lineNumber":616,"sourceCode":"\t\tif expectedMount == nil {\n\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\"'file-system' access type was not requested but was validated by the controller\"))\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tif expectedMount.FsType != capMount.FsType {\n\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\"requested filesystem type %v, got %v\",\n\t\t\t\texpectedMount.FsType, capMount.FsType))\n\t\t\tcontinue NEXT_CAP\n\t\t}\n\n\t\tfor _, expectedFlag := range expectedMount.MountFlags {\n\n\t\t\t// The mount flags can contain sensitive data, so we can't log exact\n\t\t\t// details.\n\t\t\tif !slices.Contains(capMount.MountFlags, expectedFlag) {\n\t\t\t\tmultierror.Append(&err, fmt.Errorf(\n\t\t\t\t\t\"requested mount flags did not match available capabilities\"))\n\t\t\t\tcontinue NEXT_CAP\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t}\n\treturn err.ErrorOrNil()\n}\n\nfunc (c *client) ControllerCreateSnapshot(ctx context.Context, req *ControllerCreateSnapshotRequest, opts ...grpc.CallOption) (*ControllerCreateSnapshotResponse, error) {\n\tif err := c.ensureConnected(ctx); err != nil {\n\t\treturn nil, err\n\t}\n\n\terr := req.Validate()\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":598,"sourceCodeEnd":634,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/plugins/csi/client.go#L598-L634","documentation":"compareCapabilities verifies that the volume capabilities returned by the CSI controller (e.g. from ControllerValidateCapabilities) satisfy what Nomad requested. This error is appended when a mount flag requested in the expected VolumeCapability (e.g. 'ro', mount options from the task's volume config) is not present in the plugin's returned capability's MountFlags. Per CSI spec comments in the source, exact flag details are not logged because mount flags can contain sensitive data. It means the storage plugin advertised/validated a capability that does not support the requested mount options.","triggerScenarios":"Calling ControllerValidateCapabilities where expectedMount.MountFlags contains a flag (from the job's mount_options / volume mount config) that the controller plugin's returned VolumeCapability.MountFlags does not include, causing the slices.Contains check at client.go:615 to fail for every candidate capability.","commonSituations":"Job file specifies mount_options (e.g. 'ro', 'nfsvers=4.1') unsupported by the CSI driver; driver version change dropped support for an option; driver returns UNKNOWN/partial capabilities; typo'd or driver-incompatible mount flag in host volume config.","solutions":["Remove or correct unsupported mount_options in the job's volume/volume_mount block to match what the CSI driver supports.","Query the plugin's ControllerGetCapabilities / node capability output (or driver docs) to confirm which mount flags it advertises.","Upgrade (or pin) the CSI plugin to a version that supports the requested mount flags.","Check plugin allocation logs: the exact flag is deliberately hidden here, so verify flags via driver-side debugging."],"exampleFix":"// before (job HCL)\nvolume \"data\" {\n  type = \"csi\"\n  mount_options {\n    mount_flags = [\"ro\", \"nfsvers=4.2\"]\n  }\n}\n// after: only flags the driver supports\nvolume \"data\" {\n  type = \"csi\"\n  mount_options {\n    mount_flags = [\"ro\"]\n  }\n}","handlingStrategy":"validation","validationCode":"func validateMountFlags(requested, advertised []string) error {\n  supported := map[string]bool{}\n  for _, f := range advertised { supported[f] = true }\n  for _, f := range requested {\n    if !supported[f] {\n      return fmt.Errorf(\"mount flag %q not supported by plugin\", f)\n    }\n  }\n  return nil\n}\n// call with the plugin's advertised capabilities before issuing the volume claim","typeGuard":"func hasMountFlags(cap *csipbv1.VolumeCapability, want []string) bool {\n  m := cap.GetMount()\n  if m == nil { return false }\n  for _, f := range want {\n    if !slices.Contains(m.MountFlags, f) { return false }\n  }\n  return true\n}","tryCatchPattern":"if err := compareCapabilities(expected, got); err != nil {\n  for _, sub := range err.Errors {\n    if strings.Contains(sub.Error(), \"mount flags did not match\") {\n      log.Printf(\"job requests unsupported mount options: %v\", sub)\n    }\n  }\n}","preventionTips":["Keep job mount_options limited to flags documented by your CSI driver.","Pin and test the plugin version together with job volume specs.","Run ControllerValidateCapabilities in CI against real job volume definitions.","Remember exact flags are not logged (sensitive data) — audit job specs directly when this fires."],"tags":["csi","storage","grpc","capability-validation","nomad"],"backgroundTag":"csi-capability-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}