hashicorp/nomad · error

[✘] Could not write namespace %q: %w

Error message

[✘] Could not write namespace %q: %w

What it means

createNamespace (Consul Enterprise only) creates a namespace via Consul's namespace API (nsClient.Create). Any API failure — connectivity, permissions, or the namespace feature being unavailable — is wrapped in this error. Namespaces are an Enterprise feature, so a common cause is attempting this against Consul OSS.

Source

Thrown at command/setup_consul.go:505

	existingNamespaces, _, _ := nsClient.List(nil)
	return slices.ContainsFunc(
		existingNamespaces,
		func(n *api.Namespace) bool { return n.Name == ns })
}

func (s *SetupConsulCommand) createNamespace(ns string) error {
	nsClient := s.client.Namespaces()
	namespace := &api.Namespace{
		Name: ns,
		Meta: map[string]string{
			"created-by": "nomad-setup",
		},
	}

	_, _, err := nsClient.Create(namespace, nil)
	if err != nil {
		return fmt.Errorf("[✘] Could not write namespace %q: %w", ns, err)
	}
	s.Ui.Info(fmt.Sprintf("[✔] Created namespace %q.", ns))
	return nil
}

func (s *SetupConsulCommand) bindingRuleExists(rule *api.ACLBindingRule) bool {
	qo := &api.QueryOptions{}
	if s.consulEnt {
		// binding rules are created in the default ns
		qo.Namespace = "default"
	}
	existingRules, _, _ := s.client.ACL().BindingRuleList("", qo)
	return slices.ContainsFunc(
		existingRules,
		func(r *api.ACLBindingRule) bool {
			return r.AuthMethod == rule.AuthMethod &&
				r.BindType == rule.BindType &&
				r.BindName == rule.BindName &&

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Confirm you are running Consul Enterprise >= 1.7: `consul version`; drop the -consul-ent flag / use OSS-compatible setup if you're on OSS.
2. Verify the token can manage namespaces (`consul acl token read -self`; needs acl:write / namespace write) and export CONSUL_HTTP_TOKEN accordingly.
3. Check agent reachability: `consul members`, correct CONSUL_HTTP_ADDR; inspect the wrapped %v detail for the exact API error.
4. If the namespace already exists or conflicts, list namespaces (`consul namespace list`) and reconcile manually before re-running.

Example fix

# before (OSS Consul)
nomad setup consul -consul-ent
// after (OSS)
nomad setup consul   # without -consul-ent; namespace steps skipped

// pre-flight: confirm Enterprise and namespace permissions
vers, _, err := s.client.Agent().Self()
if err != nil { return err }
if vers["Config"]["Enterprise"] == "" {
    return fmt.Errorf("namespaces require Consul Enterprise; running against OSS")
}
_, _, err = s.client.Namespaces().List(nil)
if err != nil { return fmt.Errorf("token cannot list namespaces: %v", err) }

_, _, err := nsClient.Create(namespace, nil)
if err != nil {
    if strings.Contains(err.Error(), "Permission denied") {
        return fmt.Errorf("Consul token cannot create namespaces; use a token with acl:write: %w", err)
    }
    return fmt.Errorf("[✘] Could not write namespace %q: %w", ns, err)
}

When it happens

Trigger: `nomad setup consul -consul-ent` runs and nsClient.Create(namespace, nil) errors: Consul agent unreachable, token lacks namespace write permission, Consul is OSS (not Enterprise) so the namespace endpoint returns an error, or a namespace with the same name exists in an incompatible state.

Common situations: Running the setup against Consul OSS without realizing -consul-ent (or auto-detection) triggers namespace creation; CONSUL_HTTP_TOKEN lacking write access to namespaces; network/addr misconfiguration; Consul version older than the namespace API.

Related errors

• [✘] Could not create Consul auth method: %w
• [✘] Could not create Consul binding rule: %w
• [✘] Could not create Consul role: %w
• [✘] Could not create Consul policy: %w
• no one-time token returned

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/222084549f48451c. Report an issue: GitHub.