hashicorp/nomad · error

Consul Gateway Proxy Envoy DNS Discovery type must be %s or

Error message

Consul Gateway Proxy Envoy DNS Discovery type must be %s or %s

What it means

ConsulGatewayProxy.Validate rejected the envoy_dns_discovery_type: only STRICT_DNS and LOGICAL_DNS are accepted (empty string defaults to Consul's logical DNS). Any other value in the proxy stanza fails here.

Source

Thrown at nomad/structs/services.go:2170

	strictDNS  = "STRICT_DNS"
	logicalDNS = "LOGICAL_DNS"
)

func (p *ConsulGatewayProxy) Validate() error {
	if p == nil {
		return nil
	}

	if p.ConnectTimeout == nil {
		return fmt.Errorf("Consul Gateway Proxy connection_timeout must be set")
	}

	switch p.EnvoyDNSDiscoveryType {
	case "", strictDNS, logicalDNS:
		// Consul defaults to logical DNS, suitable for large scale workloads.
		// https://www.envoyproxy.io/docs/envoy/v1.16.1/intro/arch_overview/upstream/service_discovery
	default:
		return fmt.Errorf("Consul Gateway Proxy Envoy DNS Discovery type must be %s or %s", strictDNS, logicalDNS)
	}

	for _, bindAddr := range p.EnvoyGatewayBindAddresses {
		if err := bindAddr.Validate(); err != nil {
			return err
		}
	}

	return nil
}

// ConsulGatewayTLSSDSConfig is used to configure the gateway's TLS listener to
// load certificates from an external Secret Discovery Service (SDS)
type ConsulGatewayTLSSDSConfig struct {

	// ClusterName specifies the name of the SDS cluster where Consul should
	// retrieve certificates.
	ClusterName string

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set envoy_dns_discovery_type to STRICT_DNS or LOGICAL_DNS
2. Omit envoy_dns_discovery_type to use the default LOGICAL_DNS

When it happens

Trigger: Thrown at nomad/structs/services.go:2170 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b9d26c3e6c9c04ac. Report an issue: GitHub.