ErrMultipleNamespaces

ErrMultipleNamespaces

Error message

multiple Vault namespaces requires Nomad Enterprise

What it means

ErrMultipleNamespaces is a sentinel indicating the job uses more than one Vault namespace, a Nomad Enterprise feature. In OSS builds, the job_endpoint Vault hook (validateNamespaces / job_endpoint_hook_vault_ce.go) rejects the job registration with this error, wrapping the list of offending namespaces in the message.

Source

Thrown at nomad/job_endpoint.go:38

	"github.com/hashicorp/go-set/v3"
	"github.com/hashicorp/nomad/acl"
	"github.com/hashicorp/nomad/helper"
	"github.com/hashicorp/nomad/helper/uuid"
	"github.com/hashicorp/nomad/nomad/state"
	"github.com/hashicorp/nomad/nomad/state/paginator"
	"github.com/hashicorp/nomad/nomad/structs"
	"github.com/hashicorp/nomad/scheduler"
	sstructs "github.com/hashicorp/nomad/scheduler/structs"
)

const (
	// DispatchPayloadSizeLimit is the maximum size of the uncompressed input
	// data payload.
	DispatchPayloadSizeLimit = 16 * 1024
)

// ErrMultipleNamespaces is send when multiple namespaces are used in the OSS setup
var ErrMultipleNamespaces = errors.New("multiple Vault namespaces requires Nomad Enterprise")

var (
	// allowRescheduleTransition is the transition that allows failed
	// allocations to be force rescheduled. We create a one off
	// variable to avoid creating a new object for every request.
	allowForceRescheduleTransition = &structs.DesiredTransition{
		ForceReschedule: new(true),
	}
)

// Job endpoint is used for job interactions
type Job struct {
	srv    *Server
	ctx    *RPCContext
	logger hclog.Logger

	// builtin admission controllers
	mutators   []jobMutator

View on GitHub (pinned to 482b49bf1a)

Solutions

Upgrade to Nomad Enterprise which supports multiple Vault namespaces
Use a single Vault namespace for all tasks in the job (set one vault.namespace)
Register separate jobs, each pinned to a single Vault namespace, if isolation is the goal
Note the RPC can break error wrapping (as the tests show) — match on the message text, not errors.Is, when scripting against OSS

Example fix

// before (OSS)
vault { namespace = "team-a" }
...
vault { namespace = "team-b" }
// after: single namespace per job (OSS)
vault { namespace = "team-a" }

Defensive patterns

Strategy: validation

Validate before calling

// shell: detect multi-namespace jobs before submitting to OSS
ns=$(hcl2json job.nomad | jq -r '[.. | objects | select(has("namespace")) | .namespace] | unique | length')
[ "$ns" -le 1 ] || { echo 'multiple Vault namespaces needs Nomad Enterprise'; exit 1; }

Try / catch

// Go — note: RPC may break error wrapping, so match message text
if err := client.Jobs().Register(job, nil); err != nil {
    if strings.Contains(err.Error(), "multiple Vault namespaces requires Nomad Enterprise") {
        return upgradeToEnterpriseOrSplitJob()
    }
    return err
}

Prevention

Keep one Vault namespace per job on OSS clusters
Check Nomad edition/features before migrating jobs between clusters
Split multi-team Vault jobs into per-namespace jobs on OSS
Detect the error by message text, not errors.Is, per upstream tests

When it happens

Trigger: Registering a job whose Vault blocks specify multiple distinct namespaces (vault.namespace in several task/template groups) on an OSS Nomad server; the CE hook calls validateNamespaces and len(requestedNamespaces) > 0 after reducing to the extra namespaces.

Common situations: Jobs migrated from an Enterprise cluster to OSS; multi-namespace Vault setups (one namespace per team) attempting to run on free Nomad; typo'd duplicated namespace values accidentally creating a set of >0 extra namespaces.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a29e10c6225bfd21. Report an issue: GitHub.