{"record":{"id":"d9bb87dda2c0ae72","repo":"hashicorp/nomad","slug":"could-not-write-namespace-q-w-d9bb87","errorCode":null,"errorMessage":"[✘] Could not write namespace %q: %w","messagePattern":"\\[✘\\] Could not write namespace %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":579,"sourceCode":"\t\treturn existingNamespace != nil\n\t}\n\treturn false\n}\n\nfunc (s *SetupVaultCommand) createNamespace(ns string) error {\n\ts.vClient.SetNamespace(\"\")\n\tdefer s.vClient.SetNamespace(s.ns)\n\n\t_, err := s.vLogical.Write(\n\t\t\"/sys/namespaces/\"+ns,\n\t\tmap[string]any{\n\t\t\t\"custom_metadata\": map[string]string{\n\t\t\t\t\"created-by\": \"nomad-setup\",\n\t\t\t},\n\t\t},\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not write namespace %q: %w\", ns, err)\n\t}\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created namespace %q.\", ns))\n\treturn nil\n}\n\nfunc (s *SetupVaultCommand) handleNo() {\n\ts.Ui.Warn(`\nBy answering \"no\" to any of these questions, you are risking an incorrect Vault\ncluster configuration. Nomad workloads with Workload Identity will not be able\nto authenticate unless you create missing configuration yourself.\n `)\n\n\texitCode := 0\n\tif s.autoYes || s.askQuestion(\"Remove everything this command creates? [Y/n]\") {\n\t\texitCode = s.removeConfiguredComponents()\n\t}\n\n\ts.Ui.Output(s.Colorize().Color(`","sourceCodeStart":561,"sourceCodeEnd":597,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L561-L597","documentation":"createNamespace error: writing /sys/namespaces/<ns> on the Vault Enterprise server failed, so the required namespace for the Nomad setup could not be created; the wrapped Vault error names the cause (permissions, Enterprise-only, name conflicts).","triggerScenarios":"The vLogical.Write (KV metadata write) errors: token lacks create/update on the KV mount's metadata path, KV mount doesn't exist at kvPath, or Vault connectivity failure.","commonSituations":"KV v2 mount not enabled at the configured -kv-path; token policy missing the path capability; wrong Vault address/namespace; Vault sealed.","solutions":["Enable KV v2 at the configured path (vault secrets enable -path=<kvPath> -version=2 kv) if missing","Grant the token create/update on <kvPath>/metadata/* and <kvPath>/data/*","Verify Vault connectivity, unseal state, and namespace flags"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check: vault secrets list | grep \"<kvPath>/\"  (kv v2)\n// vault token capabilities <kvPath>/metadata/<ns>  # expect: create/update","typeGuard":null,"tryCatchPattern":"var apiErr *api.ResponseError\nif errors.As(err, &apiErr) && apiErr.StatusCode == 404 {\n    // KV mount missing: vault secrets enable -path=<kvPath> -version=2 kv\n}","preventionTips":["Enable KV v2 at the configured -kv-path before setup","Grant the token access to <kvPath>/metadata/* and <kvPath>/data/*","Run vault status to confirm connectivity before setup"],"tags":["vault","kv","api-write","permissions"],"backgroundTag":"vault-api-write-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}