auto_promote must be true for all groups to enable automatic

Error message

auto_promote must be true for all groups to enable automatic promotion

What it means

Job.Validate enforces that the update block's auto_promote flag is all-or-nothing across a job's task groups: if some groups have auto_promote=true and others do not, validation fails with 'auto_promote must be true for all groups to enable automatic promotion'. Automatic promotion of canaries only works when every group opts in.

Source

Thrown at nomad/structs/structs.go:4981

		if err := tg.Warnings(j); err != nil {
			outer := fmt.Errorf("Group %q has warnings: %v", tg.Name, err)
			mErr.Errors = append(mErr.Errors, outer)
		}

		if u := tg.Update; u != nil {
			hasAutoPromote = hasAutoPromote || u.AutoPromote

			// Having no canaries implies auto-promotion since there are no canaries to promote.
			allAutoPromote = allAutoPromote && (u.Canary == 0 || u.AutoPromote)
		}
	}

	// check if we have services with no shutdown delay set
	mErr.Errors = append(mErr.Errors, j.generateServiceShutdownDelayWarnings()...)

	// Check AutoPromote, should be all or none
	if hasAutoPromote && !allAutoPromote {
		err := fmt.Errorf("auto_promote must be true for all groups to enable automatic promotion")
		mErr.Errors = append(mErr.Errors, err)
	}

	// cron -> crons
	if j.Periodic != nil && j.Periodic.Spec != "" {
		err := fmt.Errorf("cron is deprecated and may be removed in a future release. Use crons instead")
		mErr.Errors = append(mErr.Errors, err)
	}

	return mErr.ErrorOrNil()
}

// LookupTaskGroup finds a task group by name
func (j *Job) LookupTaskGroup(name string) *TaskGroup {
	if j == nil {
		return nil
	}
	for _, tg := range j.TaskGroups {

View on GitHub (pinned to 482b49bf1a)

Solutions

Set `auto_promote = true` in the update stanza of every task group.
Or set auto_promote = false everywhere (manual promotion via `nomad job promote`).
Validate the merged job spec across all groups before submitting.

Example fix

// before
group "web" { update { auto_promote = true } }
group "api" { update { canary = 1 } } // auto_promote omitted
// after
group "web" { update { auto_promote = true, canary = 1 } }
group "api" { update { auto_promote = true, canary = 1 } }

Defensive patterns

Strategy: validation

Validate before calling

var any, all bool = false, true
for _, tg := range job.TaskGroups {
    if tg.Update != nil && tg.Update.AutoPromote {
        any = true
    } else {
        all = false
    }
}
if any && !all {
    return fmt.Errorf("auto_promote must be true for all groups")
}

Prevention

Use one shared update stanza definition for all groups in a job.
Audit update blocks when adding new task groups to canary jobs.
Promote policies: pick all-automatic or all-manual per job.

When it happens

Trigger: A job with multiple task groups using `update { auto_promote = ... }` where at least one group sets auto_promote=true and at least one leaves it false/omitted (default false).

Common situations: Adding a new group to an existing canary deployment without copying its update stanza; inconsistent copy-paste of update blocks; blue/green setups with mixed promotion policies.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/732f18c0058b5233. Report an issue: GitHub.