{"record":{"id":"9fbee5dd3e1fd8f1","repo":"hashicorp/nomad","slug":"namespace-q-does-not-allow-volumes-to-use-node-po","errorCode":null,"errorMessage":"namespace %q does not allow volumes to use node pool %q","messagePattern":"namespace %q does not allow volumes to use node pool %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/host_volume_endpoint.go","lineNumber":572,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"no such node %s\", vol.NodeID)\n\t\t}\n\t\tif ok := checker.Feasible(node); !ok {\n\t\t\treturn nil, fmt.Errorf(\"node %s is not feasible for volume\", vol.NodeID)\n\t\t}\n\n\t\tvol.NodePool = node.NodePool\n\t\treturn node, nil\n\t}\n\n\tpoolFilterFn, err := v.enterpriseNodePoolFilter(snap, vol)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar iter memdb.ResultIterator\n\tif vol.NodePool != \"\" {\n\t\tif !poolFilterFn(vol.NodePool) {\n\t\t\treturn nil, fmt.Errorf(\"namespace %q does not allow volumes to use node pool %q\",\n\t\t\t\tvol.Namespace, vol.NodePool)\n\t\t}\n\t\titer, err = snap.NodesByNodePool(nil, vol.NodePool)\n\t} else {\n\t\titer, err = snap.Nodes(nil)\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar (\n\t\tfilteredByExisting    int\n\t\tfilteredByGovernance  int\n\t\tfilteredByFeasibility int\n\t)\n\n\tfor {\n\t\traw := iter.Next()","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/host_volume_endpoint.go#L554-L590","documentation":"placeHostVolume enforces node pool governance: enterpriseNodePoolFilter builds a poolFilterFn from the volume's namespace (e.g. namespace's node pool allowlist). If the requested NodePool is not permitted for that namespace, the request is rejected before any node iteration.","triggerScenarios":"Creating a host volume in a namespace whose allowed node pools (namespace.NodePools allowlist) do not include vol.NodePool — typically on Nomad Enterprise with per-namespace pool governance.","commonSituations":"Namespace configured to restrict workloads to certain pools while the volume spec targets 'all' or another pool; operator moved the namespace's allowlist after volumes were already specified; multi-tenant setups where teams create volumes in a shared namespace.","solutions":["Change the volume's NodePool to one allowed by the namespace, or omit NodePool to allow any permitted pool.","Update the namespace spec to include the desired node pool in its allowlist (`nomad namespace apply -node-pools ...`).","Create the volume in a namespace whose governance matches the target pool."],"exampleFix":"// before\nnomad namespace apply -node-pools=prod team-a\nvolume spec: NodePool: \"dev\"\n// after\nnomad namespace apply -node-pools=prod,dev team-a  (or set NodePool: \"prod\" in the volume)","handlingStrategy":"validation","validationCode":"ns, _, err := client.Namespaces().Info(vol.Namespace, nil)\nif err != nil { return err }\nif len(ns.NodePools) > 0 && !slices.Contains(ns.NodePools, vol.NodePool) {\n    return fmt.Errorf(\"namespace %q forbids node pool %q\", vol.Namespace, vol.NodePool)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the namespace's node pool allowlist in sync with volume specs.","Use IaC to manage namespace governance and volumes together.","Omit NodePool when unsure so placement uses governed candidates only."],"tags":["nomad","host-volumes","node-pool","namespace-governance","acl"],"backgroundTag":"namespace-policy-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}