{"record":{"id":"f62dfdf7857abc19","repo":"hashicorp/nomad","slug":"service-q-cannot-have-connect-block-only-servi","errorCode":null,"errorMessage":"service %q cannot have \"connect\" block, only services defined in a \"group\" block can","messagePattern":"service %q cannot have \"connect\" block, only services defined in a \"group\" block can","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":8515,"sourceCode":"\t\t}\n\t\tknownServices[service.Name+service.PortLabel] = struct{}{}\n\n\t\tif service.PortLabel != \"\" {\n\t\t\tif service.AddressMode == \"driver\" {\n\t\t\t\t// Numeric port labels are valid for address_mode=driver\n\t\t\t\t_, err := strconv.Atoi(service.PortLabel)\n\t\t\t\tif err != nil {\n\t\t\t\t\t// Not a numeric port label, add it to list to check\n\t\t\t\t\taddServicePort(service.PortLabel, service.Name)\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\taddServicePort(service.PortLabel, service.Name)\n\t\t\t}\n\t\t}\n\n\t\t// connect block is only allowed on group level\n\t\tif service.Connect != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"service %q cannot have \\\"connect\\\" block, only services defined in a \\\"group\\\" block can\", service.Name))\n\t\t}\n\n\t\t// Ensure that check names are unique and have valid ports\n\t\tknownChecks := make(map[string]struct{})\n\t\tfor _, check := range service.Checks {\n\t\t\tif _, ok := knownChecks[check.Name]; ok {\n\t\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"check %q is duplicate\", check.Name))\n\t\t\t}\n\t\t\tknownChecks[check.Name] = struct{}{}\n\n\t\t\tif check.AddressMode == AddressModeAlloc {\n\t\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"check %q cannot use address_mode=\\\"alloc\\\", only checks defined in a \\\"group\\\" service block can use this mode\", service.Name))\n\t\t\t}\n\n\t\t\tif check.AddressMode == AddressModeAllocIPv6 {\n\t\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"check %q cannot use address_mode=\\\"alloc_ipv6\\\", only checks defined in a \\\"group\\\" service block can use this mode\", service.Name))\n\t\t\t}\n","sourceCodeStart":8497,"sourceCodeEnd":8533,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L8497-L8533","documentation":"Connect (Consul service mesh) integration is only supported for services declared at the group level, because Connect sidecar proxies and networking are managed per allocation, not per task. A task-level service carrying a `connect` block is rejected during job validation.","triggerScenarios":"Submitting a job where a service nested inside a `task` block contains a `connect { sidecar_service {} }` (or any connect) stanza.","commonSituations":"Following Consul-connect examples that place service at group level but implementing them inside a task; migrating a task-scoped service to service mesh; copy-paste from group-level examples.","solutions":["Move the service (with its connect block) up to the `group` level.","Remove the connect block if mesh is not needed for the task-level service.","Re-run `nomad job validate` after restructuring to confirm compliance."],"exampleFix":"// before\ntask \"api\" {\n  service {\n    name = \"api\"\n    connect { sidecar_service {} }\n  }\n}\n\n// after\ngroup \"api\" {\n  network { mode = \"cni/bridge\" }\n  service {\n    name = \"api\"\n    connect { sidecar_service {} }\n  }\n  task \"api\" { }\n}","handlingStrategy":"validation","validationCode":"for _, tg := range job.TaskGroups {\n  for _, t := range tg.Tasks {\n    for _, s := range t.Services {\n      if s.Connect != nil {\n        return fmt.Errorf(\"service %q in task %s: connect block must be at group level\", s.Name, t.Name)\n      }\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always declare Connect-enabled services in the group block","Treat task-level services as driver-addressed only","Follow upstream Nomad Connect examples which place service at group level"],"tags":["nomad","consul-connect","service-validation","service-mesh"],"backgroundTag":"connect-block-misplaced","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}