hashicorp/nomad · error

Error querying latest job deployment: %s

Error message

Error querying latest job deployment: %s

What it means

Raised by outputJobInfo when Jobs().LatestDeployment(jobID, q) fails while fetching the most recent deployment for the status output. The API error is wrapped into this message. This is a read of deployment state, so failures typically stem from ACL restrictions, wrong namespace, connectivity loss, or older Nomad servers/agents where the deployments endpoint behaves unexpectedly.

Source

Thrown at command/job_status.go:446

	if job.Namespace != nil {
		q = &api.QueryOptions{Namespace: *job.Namespace}
	}

	// Query the allocations
	jobAllocs, _, err := client.Jobs().Allocations(*job.ID, c.allAllocs, q)
	if err != nil {
		return fmt.Errorf("Error querying job allocations: %s", err)
	}

	// Query the evaluations
	jobEvals, _, err := client.Jobs().Evaluations(*job.ID, q)
	if err != nil {
		return fmt.Errorf("Error querying job evaluations: %s", err)
	}

	latestDeployment, _, err := client.Jobs().LatestDeployment(*job.ID, q)
	if err != nil {
		return fmt.Errorf("Error querying latest job deployment: %s", err)
	}

	jobActions := make([]map[string]string, 0)
	for _, tg := range job.TaskGroups {
		for _, task := range tg.Tasks {
			for _, action := range task.Actions {
				jobActions = append(jobActions, map[string]string{
					"group":  *tg.Name,
					"task":   task.Name,
					"action": action.Name,
				})
			}
		}
	}

	// Output the summary
	if err := c.outputJobSummary(client, job); err != nil {
		return err

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Read the wrapped cause and fix it: connectivity, permissions, or server health.
2. Add deployment read permissions to the ACL policy for the namespace (deployment = read, or read all).
3. Run with the correct -namespace/-region for the job.
4. Upgrade/downgrade-align CLI and server versions if the cause is an endpoint/version mismatch, and retry on transient errors.

Example fix

// before
namespace "prod" {
  deployment = "deny"
}
// after
namespace "prod" {
  deployment = "read"
}

# ensure deployments are enabled/readable in this cluster+namespace
curl -sf -H "X-Nomad-Token: $NOMAD_TOKEN" \
  "$NOMAD_ADDR/v1/job/$JOB_ID/deployment?namespace=$NOMAD_NAMESPACE" > /dev/null

func isACLdenied(err error) bool {
    return err != nil && strings.Contains(err.Error(), "Permission denied")
}

dep, _, err := client.Jobs().LatestDeployment(id, q)
if err != nil {
    if isACLdenied(err) {
        // proceed without deployment info or fix policy
    } else {
        return err
    }
}

When it happens

Trigger: client.Jobs().LatestDeployment(*job.ID, q) returns an error: ACL token lacking deployment read in the namespace, namespace/region mismatch, network error to the agent, or server 5xx; also possible when talking to a much older Nomad version from a newer CLI.

Common situations: Restricted ACL policies on production namespaces; status run against an agent in a different region than the job; transient leader failover between sequential queries in outputJobInfo.

Related errors

• Failed to retrieve allocation %q: %w
• Error querying job: %s
• Error querying job allocations: %s
• Error querying job evaluations: %s
• Error querying job summary: %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f5aa9aa484c7d1fe. Report an issue: GitHub.