failures_before_critical may only be set for Consul service

Error message

failures_before_critical may only be set for Consul service checks

What it means

failures_before_critical (tolerate N failures before marking critical) is Consul-only; validateNomad rejects nonzero values on nomad checks because the failure-lifecycle logic exists only in Consul check handling.

Source

Thrown at nomad/structs/services.go:395

	// address_mode="driver" not yet supported on nomad
	if sc.AddressMode == "driver" {
		return errors.New("address_mode = driver may only be set for Consul service checks")
	}

	if sc.Type == "http" {
		if sc.Method != "" && !helper.IsMethodHTTP(sc.Method) {
			return fmt.Errorf("method type %q not supported in Nomad http check", sc.Method)
		}
	}

	// success_before_passing is consul only
	if sc.SuccessBeforePassing != 0 {
		return errors.New("success_before_passing may only be set for Consul service checks")
	}

	// failures_before_critical is consul only
	if sc.FailuresBeforeCritical != 0 {
		return errors.New("failures_before_critical may only be set for Consul service checks")
	}

	// failures_before_warning is consul only
	if sc.FailuresBeforeWarning != 0 {
		return errors.New("failures_before_warning may only be set for Consul service checks")
	}

	// tls_server_name is consul only
	if sc.TLSServerName != "" {
		return errors.New("tls_server_name may only be set for Consul service checks")
	}

	return nil
}

// validate a Service's ServiceCheck in the context of the Consul provider.
func (sc *ServiceCheck) validateConsul() error {
	allowable := []string{ServiceCheckGRPC, ServiceCheckTCP, ServiceCheckHTTP, ServiceCheckScript}

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove failures_before_critical from the check
Switch the service to provider = "consul" to keep the behavior
Adjust interval/timeout or check_restart limit instead

Example fix

// before
check {
  failures_before_critical = 3
}
// after
check {
  check_restart {
    limit = 3
  }
}

Defensive patterns

Strategy: validation

Validate before calling

if check.FailuresBeforeCritical != 0 && service.Provider != "consul" {
    return fmt.Errorf("check %q: failures_before_critical requires consul provider", check.Name)
}

Try / catch

if err := job.Validate(); err != nil {
    if strings.Contains(err.Error(), "failures_before_critical") {
        // remove the field or use check_restart limit instead
    }
}

Prevention

Treat failures_before_* fields as consul-only
Use check_restart.limit for restart tolerance on nomad
Validate jobs before submit

When it happens

Trigger: Setting failures_before_critical on a check of a nomad-provider service.

Common situations: Copy-pasted Consul check stanzas; attempts to soften flaky checks on nomad services.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/25ffdddb27c7801a. Report an issue: GitHub.