{"record":{"id":"89e6086fd9cf9cf8","repo":"hashicorp/nomad","slug":"ttl-must-be-between-10-seconds-and-24-hours","errorCode":null,"errorMessage":"TTL must be between 10 seconds and 24 hours","messagePattern":"TTL must be between 10 seconds and 24 hours","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/variables.go","lineNumber":77,"sourceCode":"\n\t// defaultLockTTL is the default value used to maintain a lock before it needs to\n\t// be renewed. The actual value comes from the experience with Consul.\n\tdefaultLockTTL = 15 * time.Second\n\n\t// defaultLockDelay is the default a lock will be blocked after the TTL\n\t// went by without any renews. It is intended to prevent split brain situations.\n\t// The actual value comes from the experience with Consul.\n\tdefaultLockDelay = 15 * time.Second\n)\n\nvar (\n\terrNoPath             = errors.New(\"missing path\")\n\terrNoNamespace        = errors.New(\"missing namespace\")\n\terrNoLock             = errors.New(\"missing lock ID\")\n\terrWildCardNamespace  = errors.New(\"can not target wildcard (\\\"*\\\")namespace\")\n\terrQuotaExhausted     = errors.New(\"variables are limited to 64KiB in total size\")\n\terrNegativeDelayOrTTL = errors.New(\"Lock delay and TTL must be positive\")\n\terrInvalidTTL         = errors.New(\"TTL must be between 10 seconds and 24 hours\")\n)\n\n// VariableMetadata is the metadata envelope for a Variable, it is the list\n// object and is shared data between an VariableEncrypted and a\n// VariableDecrypted object.\ntype VariableMetadata struct {\n\tNamespace string\n\tPath      string\n\n\t// Lock represents a variable which is used for locking functionality.\n\tLock *VariableLock `json:\",omitempty\"`\n\n\tCreateIndex uint64\n\tCreateTime  int64\n\tModifyIndex uint64\n\tModifyTime  int64\n}\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/variables.go#L59-L95","documentation":"VariableLock.Validate requires the lock TTL to be within [minVariableLockTTL, maxVariableLockTTL] — between 10 seconds and 24 hours per the message. A TTL outside this range (zero, too small, or exceeding 24h) triggers errInvalidTTL. This prevents locks that expire immediately or linger for days.","triggerScenarios":"Setting VariableLock.TTL below 10 seconds (including 0) or above 24 hours and calling Validate; reproduced in TestStructs_Lock_Validate with an out-of-range TTL and LockDelay: 5 * time.Second.","commonSituations":"Using time.Duration literals in wrong units (e.g. 5 * time.Second when 5 * time.Minute intended); passing a TTL in milliseconds from another system without converting; leaving TTL unset so it is 0.","solutions":["Set TTL to a duration between 10 seconds and 24 hours (e.g. 30 * time.Second).","Clamp the TTL after parsing: if ttl < 10s use 10s; if ttl > 24h use 24h.","Check the units of externally supplied TTL values (ms vs ns) and convert to time.Duration correctly."],"exampleFix":"// before\nlock := &structs.VariableLock{TTL: 5 * time.Second} // below minVariableLockTTL\n// after\nlock := &structs.VariableLock{LockDelay: 5 * time.Second, TTL: 30 * time.Second}","handlingStrategy":"validation","validationCode":"const (\n\tminTTL = 10 * time.Second\n\tmaxTTL = 24 * time.Hour\n)\nfunc lockTTLValid(ttl time.Duration) bool {\n\treturn ttl >= minTTL && ttl <= maxTTL\n}","typeGuard":null,"tryCatchPattern":"if err := lock.Validate(); err != nil {\n\tif strings.Contains(err.Error(), \"TTL must be between\") {\n\t\treturn fmt.Errorf(\"lock TTL %s out of range [10s, 24h]\", lock.TTL)\n\t}\n\treturn err\n}","preventionTips":["Clamp TTL to [10s, 24h] after parsing external input.","Double-check time.Duration units (ms vs s) when importing TTLs.","Remember zero-value TTL is invalid; always set it explicitly."],"tags":["nomad","variables","lock","ttl","validation"],"backgroundTag":"ttl-out-of-range","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}