{"record":{"id":"f5122046696108d6","repo":"hashicorp/nomad","slug":"invalid-namespace-name-v","errorCode":null,"errorMessage":"Invalid namespace name: %#v","messagePattern":"Invalid namespace name: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":571,"sourceCode":"\t\t// Hot path for empty rules\n\t\treturn p, nil\n\t}\n\n\t// Attempt to parse\n\tif err := hclDecode(p, rules); err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to parse ACL Policy: %v\", err)\n\t}\n\n\t// At least one valid policy must be specified, we don't want to store only\n\t// raw data\n\tif p.IsEmpty() {\n\t\treturn nil, fmt.Errorf(\"Invalid policy: %s\", p.Raw)\n\t}\n\n\t// Validate the policy\n\tfor _, ns := range p.Namespaces {\n\t\tif !validNamespace.MatchString(ns.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace name: %#v\", ns)\n\t\t}\n\t\tif ns.Policy != \"\" && !isPolicyValid(ns.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace policy: %#v\", ns)\n\t\t}\n\t\tfor _, cap := range ns.Capabilities {\n\t\t\tif !isNamespaceCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid namespace capability '%s': %#v\", cap, ns)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities","sourceCodeStart":553,"sourceCodeEnd":589,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L553-L589","documentation":"Returned by acl.Parse in acl/policy.go:571 when a policy's namespace stanza has a Name that fails the validNamespace regex ^[a-zA-Z0-9-*]{1,128}$ (a-Z0-9, hyphen, asterisk, wildcard, max 128 chars). The parser validates every Namespaces entry of an HCL/JSON ACL policy before building the policy object. The message formats the whole NamespacePolicy struct (%#v), not just the name, so inspect it for the bad Name field.","triggerScenarios":"Calling acl.Parse (or the Nomad API 'acl/policy' create/update endpoint) with a policy containing namespace \"name\" values containing illegal characters (spaces, dots, underscores, slashes, uppercase-free symbols), an empty name, or a name longer than 128 characters.","commonSituations":"Hand-edited HCL policies with typos like name = \"my_team\" or \"team.1\"; templated policies interpolating an empty or whitespace variable into the namespace name; tooling generating policies from team names that contain dots or underscores; migrating policies across clusters with older/newer naming rules.","solutions":["Fix the namespace 'name' field in the policy to match ^[a-zA-Z0-9-*]{1,128}$ (letters, digits, hyphen, asterisk only)","Remove leading/trailing whitespace and any interpolation that renders empty","Shorten names to 128 characters or fewer","Run acl.Parse locally or 'nomad acl policy apply' against a dev agent to pre-validate before deployment"],"exampleFix":"// before\nnamespace \"my_team\" {\n  policy = \"write\"\n}\n// after\nnamespace \"my-team\" {\n  policy = \"write\"\n}","handlingStrategy":"validation","validationCode":"var validNamespace = regexp.MustCompile(`^[a-zA-Z0-9-*]{1,128}$`)\nfor _, ns := range policy.Namespaces {\n    if !validNamespace.MatchString(ns.Name) {\n        return fmt.Errorf(\"namespace %q does not match %s\", ns.Name, validNamespace)\n    }\n}","typeGuard":"func hasValidNamespaceName(name string) bool {\n    return len(name) >= 1 && len(name) <= 128 &&\n        strings.IndexFunc(name, func(r rune) bool {\n            return !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '*')\n        }) == -1\n}","tryCatchPattern":null,"preventionTips":["Validate namespace names against ^[a-zA-Z0-9-*]{1,128}$ in CI before applying policies","Trim whitespace and reject empty interpolations in policy templates","Keep a unit test that runs acl.Parse over all checked-in policy files"],"tags":["nomad","acl","policy-validation","namespace"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}