hashicorp/nomad · error

bind type is missing

Error message

bind type is missing

What it means

Every ACLBindingRule must declare a BindType telling Nomad what the rule binds to (a role, a policy, or management). Validate() adds this error when BindType is empty, deliberately giving clearer feedback than a generic enum error.

Source

Thrown at nomad/structs/acl.go:2098

// Validate ensures the ACL binding rule contains valid information which meets
// Nomad's internal requirements.
func (a *ACLBindingRule) Validate() error {

	var mErr multierror.Error

	if a.AuthMethod == "" {
		mErr.Errors = append(mErr.Errors, errors.New("auth method is missing"))
	}
	if len(a.Description) > maxACLBindingRuleDescriptionLength {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("description longer than %d", maxACLRoleDescriptionLength))
	}

	// Depending on the bind type, we have some specific validation. Catching
	// the empty string also provides easier to understand feedback to the
	// user.
	switch a.BindType {
	case "":
		mErr.Errors = append(mErr.Errors, errors.New("bind type is missing"))
	case ACLBindingRuleBindTypeRole, ACLBindingRuleBindTypePolicy:
		if a.BindName == "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name is missing"))
		}
	case ACLBindingRuleBindTypeManagement:
		if a.BindName != "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name should be empty"))
		}
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("unsupported bind type: %q", a.BindType))
	}

	// If there is a selector configured, ensure that go-bexpr can parse this.
	// Otherwise, the user will get an ambiguous failure when attempting to
	// login.
	if a.Selector != "" {
		if _, err := bexpr.CreateEvaluator(a.Selector, nil); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("selector is invalid: %v", err))

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set BindType to ACLBindingRuleBindTypeRole ("role"), ACLBindingRuleBindTypePolicy ("policy"), or ACLBindingRuleBindTypeManagement ("management")
2. On the CLI, pass the appropriate bind-type flag
3. Validate the struct client-side with rule.Validate() before submitting

Example fix

// before
rule := &structs.ACLBindingRule{
  AuthMethod: "okoidc",
  BindName: "eng-dev",
}
// after
rule := &structs.ACLBindingRule{
  AuthMethod: "okoidc",
  BindType: structs.ACLBindingRuleBindTypePolicy,
  BindName: "eng-dev",
}

switch rule.BindType {
case structs.ACLBindingRuleBindTypeRole,
     structs.ACLBindingRuleBindTypePolicy,
     structs.ACLBindingRuleBindTypeManagement:
default:
    return fmt.Errorf("BindType must be role, policy, or management")
}

if err := rule.Validate(); err != nil {
    if strings.Contains(err.Error(), "bind type is missing") {
        // set rule.BindType and resubmit
    }
    return err
}

When it happens

Trigger: Submitting an ACLBindingRule (create/update via API or CLI) with BindType == "".

Common situations: Raw JSON payloads missing bind_type; SDK users setting only BindName; templates migrated from Vault where bind type semantics differ.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• auth method is missing
• bind name is missing
• bind name should be empty
• ACL auth method lookup failed: %v
• ACL binding rule insert failed: ACL auth method not found

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fe88d4cbf4f654e5. Report an issue: GitHub.