{"record":{"id":"ddeae92f253243ee","repo":"hashicorp/nomad","slug":"expose-may-only-be-set-on-http-or-grpc-checks","errorCode":null,"errorMessage":"expose may only be set on HTTP or gRPC checks","messagePattern":"expose may only be set on HTTP or gRPC checks","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/services.go","lineNumber":431,"sourceCode":"\tallowable := []string{ServiceCheckGRPC, ServiceCheckTCP, ServiceCheckHTTP, ServiceCheckScript}\n\tif err := sc.validateCommon(allowable); err != nil {\n\t\treturn err\n\t}\n\n\tcheckType := strings.ToLower(sc.Type)\n\n\t// Note that we cannot completely validate the Expose field yet - we do not\n\t// know whether this ServiceCheck belongs to a connect-enabled group-service.\n\t// Instead, such validation will happen in a job admission controller.\n\t//\n\t// Consul only.\n\tif sc.Expose {\n\t\t// We can however immediately ensure expose is configured only for HTTP\n\t\t// and gRPC checks.\n\t\tswitch checkType {\n\t\tcase ServiceCheckGRPC, ServiceCheckHTTP: // ok\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"expose may only be set on HTTP or gRPC checks\")\n\t\t}\n\t}\n\n\t// passFailCheckTypes are intersection of check types supported by both Consul\n\t// and Nomad when using the pass/fail check threshold features.\n\t//\n\t// Consul only.\n\tpassFailCheckTypes := []string{\"tcp\", \"http\", \"grpc\"}\n\n\tif sc.SuccessBeforePassing < 0 {\n\t\treturn fmt.Errorf(\"success_before_passing must be non-negative\")\n\t} else if sc.SuccessBeforePassing > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {\n\t\treturn fmt.Errorf(\"success_before_passing not supported for check of type %q\", sc.Type)\n\t}\n\n\tif sc.FailuresBeforeCritical < 0 {\n\t\treturn fmt.Errorf(\"failures_before_critical must be non-negative\")\n\t} else if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/services.go#L413-L449","documentation":"validateConsul rejected `expose = true` on a check whose type is neither http nor gRPC; path-basedExpose blocks only make sense for HTTP/gRPC health endpoints.","triggerScenarios":"Thrown at nomad/structs/services.go:431 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set expose only on http or gRPC checks","Remove expose from tcp/script checks"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}