{"record":{"id":"ddc4e6f2bc4ccb62","repo":"hashicorp/nomad","slug":"acl-binding-rule-not-found","errorCode":null,"errorMessage":"ACL binding rule not found","messagePattern":"ACL binding rule not found","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/state/state_store_acl_binding_rule.go","lineNumber":153,"sourceCode":"\n\t// Update the index table to indicate an update has occurred.\n\tif err := txn.Insert(tableIndex, &IndexEntry{TableACLBindingRules, index}); err != nil {\n\t\treturn fmt.Errorf(\"index update failed: %v\", err)\n\t}\n\n\treturn txn.Commit()\n}\n\n// deleteACLBindingRuleTxn deletes a single ACL binding rule from the state\n// store using the provided write transaction. It is the responsibility of the\n// caller to update the index table.\nfunc (s *StateStore) deleteACLBindingRuleTxn(txn *txn, ruleID string) error {\n\texisting, err := txn.First(TableACLBindingRules, indexID, ruleID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"ACL binding rule lookup failed: %v\", err)\n\t}\n\tif existing == nil {\n\t\treturn errors.New(\"ACL binding rule not found\")\n\t}\n\n\t// Delete the existing entry from the table.\n\tif err := txn.Delete(TableACLBindingRules, existing); err != nil {\n\t\treturn fmt.Errorf(\"ACL binding rule deletion failed: %v\", err)\n\t}\n\treturn nil\n}\n\n// GetACLBindingRules returns an iterator that contains all ACL binding rules\n// stored within state.\nfunc (s *StateStore) GetACLBindingRules(ws memdb.WatchSet) (memdb.ResultIterator, error) {\n\ttxn := s.db.ReadTxn()\n\n\t// Walk the entire table to get all ACL binding rules.\n\titer, err := txn.Get(TableACLBindingRules, indexID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ACL binding rules lookup failed: %v\", err)","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/state/state_store_acl_binding_rule.go#L135-L171","documentation":"deleteACLBindingRuleTxn looks up an ACL binding rule by ID in the acl_binding_rules table before deleting it. A nil lookup result yields \"ACL binding rule not found\" so deletes are strict rather than silently idempotent. The error surfaces through DeleteACLBindingRules to the ACLBindingRule.Delete RPC.","triggerScenarios":"ACLBindingRule.Delete RPC (nomad acl binding-rule delete <id>) with an ID that does not exist; racing duplicate deletes; IDs from a different cluster or already-removed rule.","commonSituations":"Automation cleaning up SSO binding rules with stale IDs; re-running a provisioner that already deleted the rule; copy-pasted ID from another environment.","solutions":["Run nomad acl binding-rule list to verify the rule ID before deleting.","Make automation idempotent: ignore the not-found error when the target state is 'rule absent'.","Confirm you are targeting the correct region/cluster holding the rule."],"exampleFix":"// before\nclient.ACLBindingRules().Delete(ruleID, nil)\n// after\nerr := client.ACLBindingRules().Delete(ruleID, nil)\nif err != nil && !strings.Contains(err.Error(), \"not found\") {\n    return err\n}","handlingStrategy":"try-catch","validationCode":"_, _, err := client.ACLBindingRules().Get(ruleID, nil)\nif err != nil {\n    return nil // rule already absent\n}","typeGuard":null,"tryCatchPattern":"err := client.ACLBindingRules().Delete(ruleID, nil)\nif err != nil && strings.Contains(err.Error(), \"ACL binding rule not found\") {\n    return nil // idempotent delete\n}","preventionTips":["Verify rule IDs with `nomad acl binding-rule list` in automation.","Scope deletes to the correct region/cluster.","Design provisioners to converge state rather than assume prior existence."],"tags":["nomad","acl","sso","delete-not-found"],"backgroundTag":"resource-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}