{"record":{"id":"9b1f90e5470d2843","repo":"hashicorp/nomad","slug":"failed-to-parse-rules-v","errorCode":null,"errorMessage":"failed to parse rules: %v","messagePattern":"failed to parse rules: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":375,"sourceCode":"func (a *ACLPolicy) Stub() *ACLPolicyListStub {\n\treturn &ACLPolicyListStub{\n\t\tName:        a.Name,\n\t\tDescription: a.Description,\n\t\tJobACL:      a.JobACL,\n\t\tHash:        a.Hash,\n\t\tCreateIndex: a.CreateIndex,\n\t\tModifyIndex: a.ModifyIndex,\n\t}\n}\n\nfunc (a *ACLPolicy) Validate() error {\n\tvar mErr multierror.Error\n\tif !ValidPolicyName.MatchString(a.Name) {\n\t\terr := fmt.Errorf(\"invalid name '%s'\", a.Name)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif _, err := acl.Parse(a.Rules, acl.PolicyParseStrict); err != nil {\n\t\terr = fmt.Errorf(\"failed to parse rules: %v\", err)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif len(a.Description) > maxPolicyDescriptionLength {\n\t\terr := fmt.Errorf(\"description longer than %d\", maxPolicyDescriptionLength)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif a.JobACL != nil {\n\t\tif a.JobACL.JobID != \"\" && a.JobACL.Namespace == \"\" {\n\t\t\terr := fmt.Errorf(\"namespace must be set to set job ID\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t\tif a.JobACL.Group != \"\" && a.JobACL.JobID == \"\" {\n\t\t\terr := fmt.Errorf(\"job ID must be set to set group\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t\tif a.JobACL.Task != \"\" && a.JobACL.Group == \"\" {\n\t\t\terr := fmt.Errorf(\"group must be set to set task\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L357-L393","documentation":"ACLPolicy.Validate attempts to parse the policy's HCL rules with hashicorp's acl.Parse in strict mode (acl.PolicyParseStrict) and wraps any parse failure as 'failed to parse rules: %v'. This ensures only syntactically valid, fully-known policy documents are stored. The underlying parser error details the offending line/statement.","triggerScenarios":"Creating or updating an ACL policy (via `nomad acl policy apply` or the ACL API) whose Rules HCL is malformed, contains unknown/misspelled stanzas (strict mode rejects unknown keys), or mixes incompatible syntax.","commonSituations":"Hand-written HCL with typos like 'namespace \"*\" { capabilities = [\"list-jobs\"' missing a bracket or quote; copying Consul ACL rules into Nomad policies; stale rules using capabilities renamed across Nomad versions; templating mistakes injecting empty or truncated HCL.","solutions":["Read the wrapped parser error for the exact line and fix the HCL syntax.","Validate the rules with `nomad acl policy apply` against a test name or use a local HCL linter before applying.","Ensure only supported stanzas (namespace, node, agent, plugin, quota, key, etc.) and capabilities are used; remove unknown keys since strict mode rejects them.","Compare against a known-good policy from `nomad acl policy info` and correct differences."],"exampleFix":"// before (Rules)\nnamespace \"*\" { capabilites = [\"list-jobs\"] }\n// after\nnamespace \"*\" { capabilities = [\"list-jobs\"] }","handlingStrategy":"validation","validationCode":"func validateRules(rules string) error {\n    _, err := acl.Parse(rules, acl.PolicyParseStrict)\n    return err // call before submitting the policy\n}","typeGuard":null,"tryCatchPattern":"if err := policy.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"failed to parse rules\") {\n        return fmt.Errorf(\"fix policy HCL: %w\", err)\n    }\n    return err\n}","preventionTips":["Lint policy HCL in CI with acl.Parse strict mode before applying.","Only use documented Nomad policy stanzas and capabilities (strict mode rejects unknown keys).","Never paste Consul ACL rules verbatim into Nomad policies.","Template-generated policies: assert the rendered HCL is non-empty and balanced before submit."],"tags":["acl","validation","hcl","parse-error"],"backgroundTag":"acl-rules-parse-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}