{"record":{"id":"d681e54accc98774","repo":"hashicorp/nomad","slug":"invalid-host-volume-name-v","errorCode":null,"errorMessage":"Invalid host volume name: %#v","messagePattern":"Invalid host volume name: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":644,"sourceCode":"\t\t}\n\t\tfor _, cap := range np.Capabilities {\n\t\t\tif !isNodePoolCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid node pool capability '%s' for '%s'\", cap, np.Name)\n\t\t\t}\n\t\t}\n\n\t\tif np.Policy != \"\" {\n\t\t\textraCap := expandNodePoolPolicy(np.Policy)\n\t\t\tnp.Capabilities = append(np.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Remove the node-pool name from the extra key list.\n\t\tp.removeExtraKey(np.Name)\n\t}\n\n\tfor _, hv := range p.HostVolumes {\n\t\tif !validVolume.MatchString(hv.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid host volume name: %#v\", hv)\n\t\t}\n\t\tif hv.Policy != \"\" && !isPolicyValid(hv.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid host volume policy: %#v\", hv)\n\t\t}\n\t\tfor _, cap := range hv.Capabilities {\n\t\t\tif !isHostVolumeCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid host volume capability '%s': %#v\", cap, hv)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif hv.Policy != \"\" {\n\t\t\textraCap := expandHostVolumePolicy(hv.Policy)\n\t\t\thv.Capabilities = append(hv.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Remove the host-volume name from the extra key list.","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L626-L662","documentation":"Nomad's acl.Parse() (acl/policy.go:643) validates every host_volume block's name against the regex ^[a-zA-Z0-9-*]{1,128}$ before compiling the ACL. If the name is empty, longer than 128 chars, or contains characters outside alphanumerics, hyphen, asterisk (e.g. '/', '_', ':' or whitespace), parsing fails and the whole policy is rejected. The offending HostVolumePolicy struct is printed with %#v to identify the bad block.","triggerScenarios":"Calling acl.Parse(rules, strict) (or the Nomad API 'PUT /v1/acl/policy' endpoint) where the HCL/JSON policy contains a host_volume block whose key (the volume name) does not match validVolume: empty name, name with '/' or '_' or spaces, or a name exceeding 128 characters.","commonSituations":"Typing a volume name copied from a job spec that uses underscores or slashes (e.g. 'web_data' or 'data/vol1'); forgetting the volume name entirely ('host_volume { ... }'); scripting policy generation that substitutes an empty or multiline variable into the name.","solutions":["Rename the host_volume block key so it only contains letters, digits, hyphens, or asterisks and is 1-128 characters long (e.g. host_volume \"web-data\" { ... }).","If the name was templated, verify the substituted variable is non-empty and contains no '/', '_', or whitespace before generating the policy.","Check the printed %#v struct in the error to see which host_volume block has the bad Name and fix just that one."],"exampleFix":"// before\nhost_volume \"data/vol1\" {\n  policy = \"read\"\n}\n// after\nhost_volume \"data-vol1\" {\n  policy = \"read\"\n}","handlingStrategy":"validation","validationCode":"var validVolume = regexp.MustCompile(`^[a-zA-Z0-9-*]{1,128}$`)\nfor _, hv := range policy.HostVolumes {\n    if !validVolume.MatchString(hv.Name) {\n        return fmt.Errorf(\"host volume %q must match [a-zA-Z0-9-*]{1,128}\", hv.Name)\n    }\n}","typeGuard":"func isValidHostVolumeName(name string) bool {\n    return regexp.MustCompile(`^[a-zA-Z0-9-*]{1,128}$`).MatchString(name)\n}","tryCatchPattern":"_, err := acl.Parse(rules, acl.PolicyParseStrict)\nif err != nil {\n    if strings.Contains(err.Error(), \"Invalid host volume name\") {\n        // surface which volume name failed and fix the HCL\n    }\n    return err\n}","preventionTips":["Use only [a-zA-Z0-9-*] characters in host_volume names; replace '_' and '/' with '-'","Never template volume names without validating the substituted value is non-empty and <= 128 chars","Lint policy HCL with nomad acl policy apply against a test cluster before production"],"tags":["nomad","acl","policy-validation","host-volume"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}