hashicorp/nomad · error

[✘] Could not create Consul policy: %w

Error message

[✘] Could not create Consul policy: %w

What it means

createPolicy creates the 'nomad-workloads' Consul ACL policy (node/service/event-stream rules) via ACL().PolicyCreate. Any API error — connectivity, insufficient token privileges, or malformed policy rules — is wrapped here.

Source

Thrown at command/setup_consul.go:578

	s.Ui.Info(fmt.Sprintf("[✔] Created role %q.", consulRoleTasks))
	return nil
}

func (s *SetupConsulCommand) policyExists() bool {
	existingPolicies, _, _ := s.client.ACL().PolicyList(nil)
	return slices.ContainsFunc(
		existingPolicies,
		func(p *api.ACLPolicyListEntry) bool { return p.Name == consulPolicyName })
}

func (s *SetupConsulCommand) createPolicy() error {
	_, _, err := s.client.ACL().PolicyCreate(&api.ACLPolicy{
		Name:  consulPolicyName,
		Rules: string(consulPolicyBody),
	}, nil)
	if err != nil {
		return fmt.Errorf("[✘] Could not create Consul policy: %w", err)
	}

	s.Ui.Info(fmt.Sprintf("[✔] Created policy %q.", consulPolicyName))

	return nil
}

func (s *SetupConsulCommand) handleNo() {
	s.Ui.Warn(`
By answering "no" to any of these questions, you are risking an incorrect Consul
cluster configuration. Nomad workloads with Workload Identity will not be able
to authenticate unless you create missing configuration yourself.
`)

	exitCode := 0
	if s.autoYes || s.askQuestion("Remove everything this command creates? [Y/n]") {
		exitCode = s.removeConfiguredComponents()
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Export a token with acl:write (management token) and retry: `export CONSUL_HTTP_TOKEN=<token>`; check with `consul acl token read -self`.
2. Ensure ACLs are enabled: check `acl.enabled` in the Consul agent config or `consul acl bootstrap` if never bootstrapped.
3. Verify connectivity (`consul members`, CONSUL_HTTP_ADDR) and read the wrapped underlying error to see Consul's exact rejection.
4. If the policy already exists from an earlier run, that's expected (setup skips it); otherwise update it manually via `consul acl policy update -name nomad-workloads` if rules are rejected.

Example fix

# before
nomad setup consul   # ACLs disabled on server
// after
# enable in Consul server config: "acl": { "enabled": true, "default_policy": "deny" }
consul acl bootstrap            # get management token
export CONSUL_HTTP_TOKEN=<secret-id>
nomad setup consul

// pre-flight: ACLs enabled and token can write
info, err := s.client.Agent().Self()
if err != nil { return err }
if cfg, ok := info["DebugConfig"]; ok && cfg["ACLDatacenter"] == "" /* or acl.enabled false */ {
    return fmt.Errorf("Consul ACLs are not enabled; enable acl.enabled and bootstrap first")
}
_, _, err = s.client.ACL().PolicyList(nil)
if err != nil { return fmt.Errorf("token cannot list policies (missing/insufficient CONSUL_HTTP_TOKEN?): %v", err) }

_, _, err := s.client.ACL().PolicyCreate(policy, nil)
if err != nil {
    if strings.Contains(err.Error(), "Permission denied") {
        return fmt.Errorf("use a management/acl:write token in CONSUL_HTTP_TOKEN: %w", err)
    }
    if strings.Contains(err.Error(), "ACL not enabled") {
        return fmt.Errorf("enable ACLs in Consul config and run 'consul acl bootstrap': %w", err)
    }
    return fmt.Errorf("[✘] Could not create Consul policy: %w", err)
}

When it happens

Trigger: `nomad setup consul` calls PolicyCreate and errors: Consul agent unreachable, the token lacks acl:write (policy creation requires management-level privileges or acl:write on policies), the ACL system is not enabled in Consul, or the compiled-in policy rules are rejected by the Consul version in use.

Common situations: CONSUL_HTTP_TOKEN absent or read-only; ACLs not bootstrapped/enabled on the Consul cluster; old Consul version not recognizing newer policy syntax (e.g. service identities or event streaming rules); wrong CONSUL_HTTP_ADDR pointing at an unreachable agent.

Related errors

• [✘] Could not create Consul auth method: %w
• [✘] Could not write namespace %q: %w
• [✘] Could not create Consul binding rule: %w
• [✘] Could not create Consul role: %w
• no one-time token returned

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/41644fde62b2b563. Report an issue: GitHub.