hashicorp/nomad · error

[✘] Could not write namespace %q: %w

Error message

[✘] Could not write namespace %q: %w

What it means

createNamespace error: writing /sys/namespaces/<ns> on the Vault Enterprise server failed, so the required namespace for the Nomad setup could not be created; the wrapped Vault error names the cause (permissions, Enterprise-only, name conflicts).

Source

Thrown at command/setup_vault.go:579

		return existingNamespace != nil
	}
	return false
}

func (s *SetupVaultCommand) createNamespace(ns string) error {
	s.vClient.SetNamespace("")
	defer s.vClient.SetNamespace(s.ns)

	_, err := s.vLogical.Write(
		"/sys/namespaces/"+ns,
		map[string]any{
			"custom_metadata": map[string]string{
				"created-by": "nomad-setup",
			},
		},
	)
	if err != nil {
		return fmt.Errorf("[✘] Could not write namespace %q: %w", ns, err)
	}
	s.Ui.Info(fmt.Sprintf("[✔] Created namespace %q.", ns))
	return nil
}

func (s *SetupVaultCommand) handleNo() {
	s.Ui.Warn(`
By answering "no" to any of these questions, you are risking an incorrect Vault
cluster configuration. Nomad workloads with Workload Identity will not be able
to authenticate unless you create missing configuration yourself.
 `)

	exitCode := 0
	if s.autoYes || s.askQuestion("Remove everything this command creates? [Y/n]") {
		exitCode = s.removeConfiguredComponents()
	}

	s.Ui.Output(s.Colorize().Color(`

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Enable KV v2 at the configured path (vault secrets enable -path=<kvPath> -version=2 kv) if missing
2. Grant the token create/update on <kvPath>/metadata/* and <kvPath>/data/*
3. Verify Vault connectivity, unseal state, and namespace flags

// pre-check: vault secrets list | grep "<kvPath>/"  (kv v2)
// vault token capabilities <kvPath>/metadata/<ns>  # expect: create/update

var apiErr *api.ResponseError
if errors.As(err, &apiErr) && apiErr.StatusCode == 404 {
    // KV mount missing: vault secrets enable -path=<kvPath> -version=2 kv
}

When it happens

Trigger: The vLogical.Write (KV metadata write) errors: token lacks create/update on the KV mount's metadata path, KV mount doesn't exist at kvPath, or Vault connectivity failure.

Common situations: KV v2 mount not enabled at the configured -kv-path; token policy missing the path capability; wrong Vault address/namespace; Vault sealed.

Related errors

• [✘] Could not create Vault role: %w
• [✘] Could not create Vault policy: %w
• failed to recover vault token from %s: %v
• failed to write vault token to secrets dir: %v
• failed to write vault token: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d9bb87dda2c0ae72. Report an issue: GitHub.