hashicorp/nomad · error

Connect proxy task must not have leader set

Error message

Connect proxy task must not have leader set

What it means

Connect proxy tasks cannot be marked as leaders; Task.Validate emits "Connect proxy task must not have leader set" when a task with kind connect-proxy has `leader = true`. Leadership semantics apply to application tasks, not the injected Envoy proxy.

Source

Thrown at nomad/structs/structs.go:8385

		}
	}

	// Validate the Lifecycle block if there
	if t.Lifecycle != nil {
		if err := t.Lifecycle.Validate(); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Lifecycle validation failed: %v", err))
		}

	}

	// Validation for TaskKind field which is used for Consul Connect integration
	if t.Kind.IsConnectProxy() {
		// This task is a Connect proxy so it should not have service blocks
		if len(t.Services) > 0 {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Connect proxy task must not have a service block"))
		}
		if t.Leader {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Connect proxy task must not have leader set"))
		}

		// Ensure the proxy task has a corresponding service entry
		serviceErr := ValidateConnectProxyService(t.Kind.Value(), tg.Services)
		if serviceErr != nil {
			mErr.Errors = append(mErr.Errors, serviceErr)
		}
	}

	// Validation for volumes
	for idx, vm := range t.VolumeMounts {
		if _, ok := tg.Volumes[vm.Volume]; !ok {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Volume Mount (%d) references undefined volume %s", idx, vm.Volume))
		}

		if err := vm.Validate(); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Volume Mount (%d) is invalid: \"%w\"", idx, err))
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove `leader = true` from the connect-proxy task
2. Keep leader flags only on application tasks in the group
3. Validate with `nomad job validate` before submit

Example fix

// before
task "connect-proxy-api" {
  kind   = "connect-proxy:api"
  leader = true
}
// after
task "connect-proxy-api" {
  kind = "connect-proxy:api"
}

if task.Kind.IsConnectProxy() && task.Leader {
    return fmt.Errorf("connect proxy task %q cannot be leader", task.Name)
}

func isConnectProxy(t *structs.Task) bool { return t.Kind.IsConnectProxy() }

if err := job.Validate(); err != nil {
    if strings.Contains(err.Error(), "must not have leader set") { /* remove leader flag */ }
}

When it happens

Trigger: A task stanza with `kind = "connect-proxy:..."` and `leader = true` in the same task.

Common situations: Copying a leader app task as a template for the proxy task; tools that patch task fields and set leader globally.

Related errors

• Connect proxy task must not have a service block
• error creating bootstrap configuration for Connect proxy sid
• expose may only be set for Consul service checks
• on_update may only be set to ignore_warnings for Consul serv
• ignore_warnings on check_restart only supported for Consul s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/907ab4be0879b83c. Report an issue: GitHub.