{"record":{"id":"907ab4be0879b83c","repo":"hashicorp/nomad","slug":"connect-proxy-task-must-not-have-leader-set","errorCode":null,"errorMessage":"Connect proxy task must not have leader set","messagePattern":"Connect proxy task must not have leader set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":8385,"sourceCode":"\t\t}\n\t}\n\n\t// Validate the Lifecycle block if there\n\tif t.Lifecycle != nil {\n\t\tif err := t.Lifecycle.Validate(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Lifecycle validation failed: %v\", err))\n\t\t}\n\n\t}\n\n\t// Validation for TaskKind field which is used for Consul Connect integration\n\tif t.Kind.IsConnectProxy() {\n\t\t// This task is a Connect proxy so it should not have service blocks\n\t\tif len(t.Services) > 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Connect proxy task must not have a service block\"))\n\t\t}\n\t\tif t.Leader {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Connect proxy task must not have leader set\"))\n\t\t}\n\n\t\t// Ensure the proxy task has a corresponding service entry\n\t\tserviceErr := ValidateConnectProxyService(t.Kind.Value(), tg.Services)\n\t\tif serviceErr != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, serviceErr)\n\t\t}\n\t}\n\n\t// Validation for volumes\n\tfor idx, vm := range t.VolumeMounts {\n\t\tif _, ok := tg.Volumes[vm.Volume]; !ok {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Volume Mount (%d) references undefined volume %s\", idx, vm.Volume))\n\t\t}\n\n\t\tif err := vm.Validate(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Volume Mount (%d) is invalid: \\\"%w\\\"\", idx, err))\n\t\t}","sourceCodeStart":8367,"sourceCodeEnd":8403,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L8367-L8403","documentation":"Connect proxy tasks cannot be marked as leaders; Task.Validate emits \"Connect proxy task must not have leader set\" when a task with kind connect-proxy has `leader = true`. Leadership semantics apply to application tasks, not the injected Envoy proxy.","triggerScenarios":"A task stanza with `kind = \"connect-proxy:...\"` and `leader = true` in the same task.","commonSituations":"Copying a leader app task as a template for the proxy task; tools that patch task fields and set leader globally.","solutions":["Remove `leader = true` from the connect-proxy task","Keep leader flags only on application tasks in the group","Validate with `nomad job validate` before submit"],"exampleFix":"// before\ntask \"connect-proxy-api\" {\n  kind   = \"connect-proxy:api\"\n  leader = true\n}\n// after\ntask \"connect-proxy-api\" {\n  kind = \"connect-proxy:api\"\n}","handlingStrategy":"validation","validationCode":"if task.Kind.IsConnectProxy() && task.Leader {\n    return fmt.Errorf(\"connect proxy task %q cannot be leader\", task.Name)\n}","typeGuard":"func isConnectProxy(t *structs.Task) bool { return t.Kind.IsConnectProxy() }","tryCatchPattern":"if err := job.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"must not have leader set\") { /* remove leader flag */ }\n}","preventionTips":["Set leader only on application tasks","Don't blanket-apply leader=true in job templates","Lint generated task stanzas for kind/leader combinations"],"tags":["nomad","connect","consul","leader","validation"],"backgroundTag":"connect-proxy-config-invalid","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}