{"record":{"id":"f49d9e45bfe723f8","repo":"hashicorp/nomad","slug":"used-group-network-modes-q-are-not-allowed-in-nam","errorCode":null,"errorMessage":"used group network modes %q are not allowed in namespace %q","messagePattern":"used group network modes %q are not allowed in namespace %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_validators.go","lineNumber":67,"sourceCode":"\t\t}\n\t}\n\n\tvar disallowedNetworkModes []string\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, network := range tg.Networks {\n\t\t\tif allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {\n\t\t\t\tdisallowedNetworkModes = append(disallowedNetworkModes, network_mode)\n\t\t\t}\n\t\t}\n\t}\n\tif len(disallowedNetworkModes) > 0 {\n\t\tif len(disallowedNetworkModes) == 1 {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used group network mode %q is not allowed in namespace %q\", disallowedNetworkModes[0], ns.Name,\n\t\t\t)\n\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"used group network modes %q are not allowed in namespace %q\", disallowedNetworkModes, ns.Name,\n\t\t\t)\n\t\t}\n\t}\n\n\treturn nil, nil\n}\n\nfunc taskValidateNetworkMode(network *structs.NetworkResource, ns *structs.Namespace) (bool, string) {\n\tnetwork_mode := \"host\"\n\tif len(network.Mode) > 0 {\n\t\tnetwork_mode = network.Mode\n\t}\n\tif ns.Capabilities == nil {\n\t\treturn true, network_mode\n\t}\n\tallow := len(ns.Capabilities.EnabledNetworkModes) == 0\n\tif slices.Contains(ns.Capabilities.EnabledNetworkModes, network_mode) {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_validators.go#L49-L85","documentation":"Plural counterpart of the single disallowed network mode error: raised when two or more group network modes in the job are not allowed by the namespace policy. The message lists all offending modes via Go %q of a slice plus the namespace name.","triggerScenarios":"Registering a job where 2+ task groups use network modes disallowed by the namespace's network policy. Raised in Validate when len(disallowedNetworkModes) > 1.","commonSituations":"Multi-group jobs mixing host and cni modes in a bridge-only namespace; namespace policy changed after a heterogeneous job was already deployed; templates generating groups with varied network modes.","solutions":["Rewrite the offending groups' network blocks to allowed modes","Extend the namespace's allowed network modes list","Split groups into different namespaces matching their network requirements"],"exampleFix":"// before\n// groups use \"host\" and \"cni/custom\", namespace allows [\"bridge\"]\n// after\nnomad namespace apply -allow-network=host,cni/custom team\n// or set all groups to network { mode = \"bridge\" }","handlingStrategy":"validation","validationCode":"// before submit\nns, _ := client.Namespaces().Info(job.Namespace, nil)\nvar badModes []string\nfor _, tg := range job.TaskGroups {\n  for _, n := range tg.Networks {\n    if !networkModeAllowedInNamespace(ns, n.Mode) { badModes = append(badModes, n.Mode) }\n  }\n}\nif len(badModes) > 0 { return fmt.Errorf(\"disallowed network modes: %v\", badModes) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize one network mode per namespace to avoid plural violations","Audit all task groups (not just the first) in pre-submit checks","Sync namespace network policy changes with dependent job templates"],"tags":["nomad","namespace","network-mode","job-validation"],"backgroundTag":"network-mode-not-allowed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}