failures_before_warning may only be set for Consul service c

Error message

failures_before_warning may only be set for Consul service checks

What it means

Service check validation in validateNomad: failures_before_warning was set on a Nomad-native check; this Consul-only field (warning threshold before critical) has no meaning for Nomad checks and is rejected.

Source

Thrown at nomad/structs/services.go:400

	if sc.Type == "http" {
		if sc.Method != "" && !helper.IsMethodHTTP(sc.Method) {
			return fmt.Errorf("method type %q not supported in Nomad http check", sc.Method)
		}
	}

	// success_before_passing is consul only
	if sc.SuccessBeforePassing != 0 {
		return errors.New("success_before_passing may only be set for Consul service checks")
	}

	// failures_before_critical is consul only
	if sc.FailuresBeforeCritical != 0 {
		return errors.New("failures_before_critical may only be set for Consul service checks")
	}

	// failures_before_warning is consul only
	if sc.FailuresBeforeWarning != 0 {
		return errors.New("failures_before_warning may only be set for Consul service checks")
	}

	// tls_server_name is consul only
	if sc.TLSServerName != "" {
		return errors.New("tls_server_name may only be set for Consul service checks")
	}

	return nil
}

// validate a Service's ServiceCheck in the context of the Consul provider.
func (sc *ServiceCheck) validateConsul() error {
	allowable := []string{ServiceCheckGRPC, ServiceCheckTCP, ServiceCheckHTTP, ServiceCheckScript}
	if err := sc.validateCommon(allowable); err != nil {
		return err
	}

	checkType := strings.ToLower(sc.Type)

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove failures_before_warning from the check
Move the service to provider = "consul" if warning-stage behavior is needed
Use on_update/ignore semantics or check_restart limits instead

Example fix

// before
check {
  failures_before_warning = 2
}
// after
check {
  on_update = "ignore_warn"
}

Defensive patterns

Strategy: validation

Validate before calling

if check.FailuresBeforeWarning != 0 && service.Provider != "consul" {
    return fmt.Errorf("check %q: failures_before_warning requires consul provider", check.Name)
}

Try / catch

if err := job.Validate(); err != nil {
    if strings.Contains(err.Error(), "failures_before_warning") {
        // remove the field or move service to consul
    }
}

Prevention

Remember nomad checks have no warning state
Keep consul-only fields in consul provider templates only
Run nomad job validate in CI

When it happens

Trigger: Setting failures_before_warning on a check of a non-Consul service.

Common situations: Consul check tuning carried into nomad services; shared check templates across providers.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4f86a47197e4b44f. Report an issue: GitHub.