hashicorp/nomad · error

Invalid missing variable path in namespace %s

Error message

Invalid missing variable path in namespace %s

What it means

Returned by acl.Parse in acl/policy.go:598 when a variables path block has an empty PathSpec — i.e. a path entry exists but its path string is "". Every variables path must specify a non-empty path pattern against which ACL matching is done.

Source

Thrown at acl/policy.go:598

		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if ns.Policy != "" {
			extraCap := expandNamespacePolicy(ns.Policy)
			ns.Capabilities = append(ns.Capabilities, extraCap...)
		}

		// Expand implicit capabilities
		expandNamespaceCapabilities(ns)

		if ns.Variables != nil {
			if len(ns.Variables.Paths) == 0 {
				return nil, fmt.Errorf("Invalid variable policy: no variable paths in namespace %s", ns.Name)
			}
			for _, pathPolicy := range ns.Variables.Paths {
				if pathPolicy.PathSpec == "" {
					return nil, fmt.Errorf("Invalid missing variable path in namespace %s", ns.Name)
				}
				if strings.HasPrefix(pathPolicy.PathSpec, "/") {
					return nil, fmt.Errorf(
						"Invalid variable path %q in namespace %s: cannot start with a leading '/'`",
						pathPolicy.PathSpec, ns.Name)
				}
				for _, cap := range pathPolicy.Capabilities {
					if !isPathCapabilityValid(cap) {
						return nil, fmt.Errorf(
							"Invalid variable capability '%s' in namespace %s", cap, ns.Name)
					}
				}
				pathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)

			}
		}

		// Remove the namespace name from the extra key list.

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set a concrete non-empty path spec, e.g. path "secret/team/app"
2. Remove the empty path block entirely
3. Fix the template so the path variable is never empty (add validation/default)
4. Pre-check all pathPolicy.PathSpec values with a non-empty string validation before calling Parse

Example fix

// before
variables {
  path "" {
    capabilities = ["read"]
  }
}
// after
variables {
  path "secret/team/app" {
    capabilities = ["read"]
  }
}

for _, ns := range policy.Namespaces {
    if ns.Variables == nil { continue }
    for _, p := range ns.Variables.Paths {
        if strings.TrimSpace(p.PathSpec) == "" {
            return fmt.Errorf("namespace %s: empty variables path", ns.Name)
        }
    }
}

func hasNonEmptyPathSpec(spec string) bool { return strings.TrimSpace(spec) != "" }

When it happens

Trigger: Calling acl.Parse with path "" { ... } inside a variables stanza, or JSON policy where a path object has pathspec/path set to empty string; typically from variable interpolation producing an empty value.

Common situations: Terraform/template variables like path "${var.secret_path}" resolving to empty; copy-paste creating a path block whose name line was deleted; JSON-to-HCL converters emitting empty path keys.

Related errors

• Invalid variable policy: no variable paths in namespace %s
• Invalid namespace name: %#v
• Invalid namespace policy: %#v
• Invalid namespace capability '%s': %#v
• Invalid variable path %q in namespace %s: cannot start with

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/51f4364c1d375218. Report an issue: GitHub.