{"record":{"id":"c261eab743519474","repo":"hashicorp/nomad","slug":"check-s-invalid-tcp-checks-are-not-valid-for-con","errorCode":null,"errorMessage":"Check %s invalid: tcp checks are not valid for Connect enabled services","messagePattern":"Check (.+?) invalid: tcp checks are not valid for Connect enabled services","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":865,"sourceCode":"\treturn nil\n}\n\n// validateConsulService performs validation on a service which is using the\n// consul provider.\nfunc (s *Service) validateConsulService(mErr *multierror.Error) {\n\t// check checks\n\tfor _, c := range s.Checks {\n\t\t// validate the check port\n\t\tif err := s.validateCheckPort(c); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\tcontinue\n\t\t}\n\n\t\t// TCP checks against a Consul Connect enabled service are not supported\n\t\t// due to the service being bound to the loopback interface inside the\n\t\t// network namespace\n\t\tif c.Type == ServiceCheckTCP && s.Connect != nil && s.Connect.SidecarService != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Check %s invalid: tcp checks are not valid for Connect enabled services\", c.Name))\n\t\t\tcontinue\n\t\t}\n\n\t\t// validate the consul check\n\t\tif err := c.validateConsul(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Check %s invalid: %v\", c.Name, err))\n\t\t}\n\t}\n\n\t// validate the consul service kind\n\tswitch api.ServiceKind(s.Kind) {\n\tcase api.ServiceKindTypical,\n\t\tapi.ServiceKindAPIGateway,\n\t\tapi.ServiceKindIngressGateway,\n\t\tapi.ServiceKindMeshGateway,\n\t\tapi.ServiceKindTerminatingGateway:\n\tdefault:\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Service %s kind must be one of consul service kind or empty\", s.Name))","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L847-L883","documentation":"This error is raised in validateConsulService when a TCP check is attached to a Consul Connect-enabled service (service has a connect stanza with a sidecar_service). TCP checks hit the service's loopback-bound address inside the network namespace and cannot work, so Nomad rejects the configuration up front.","triggerScenarios":"A service stanza with `connect { sidecar_service {} }` and a check of type = \"tcp\".","commonSituations":"Adding a standard TCP health check to a service that was later converted to use Consul Connect; migrating a plain service to Connect and keeping existing checks.","solutions":["Change the check type to \"http\" or \"grpc\" targeting the sidecar proxy (e.g. address_mode = \"driver\", port pointing at the proxy port).","Remove the TCP check and rely on Consul's mesh health or an application-level HTTP check.","Drop the connect stanza if Connect is not actually needed."],"exampleFix":"// before\nservice {\n  name = \"web\"\n  connect { sidecar_service {} }\n  check { type = \"tcp\" interval = \"10s\" timeout = \"2s\" }\n}\n// after\nservice {\n  name = \"web\"\n  connect { sidecar_service {} }\n  check {\n    type = \"http\"\n    path = \"/health\"\n    port = \"9090\"\n    interval = \"10s\"\n    timeout = \"2s\"\n  }\n}","handlingStrategy":"validation","validationCode":"func validateConnectChecks(svc Service) error {\n  if svc.Connect != nil && svc.Connect.SidecarService != nil {\n    for _, c := range svc.Checks {\n      if c.Type == \"tcp\" {\n        return fmt.Errorf(\"check %q: tcp not allowed on Connect-enabled services\", c.Name)\n      }\n    }\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use http or grpc checks against the sidecar proxy port for Connect services","Document that TCP checks are incompatible with Connect in your job templates","Review checks whenever migrating a service to Connect"],"tags":["nomad","consul-connect","service-check","validation"],"backgroundTag":"tcp-check-connect-incompatible","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}