What causes "Invalid namespace name: %#v" in hashicorp/nomad?

Fix the namespace 'name' field in the policy to match ^[a-zA-Z0-9-*]{1,128}$ (letters, digits, hyphen, asterisk only)

Invalid namespace name: %#v

Error message

Invalid namespace name: %#v

What it means

Returned by acl.Parse in acl/policy.go:571 when a policy's namespace stanza has a Name that fails the validNamespace regex ^[a-zA-Z0-9-*]{1,128}$ (a-Z0-9, hyphen, asterisk, wildcard, max 128 chars). The parser validates every Namespaces entry of an HCL/JSON ACL policy before building the policy object. The message formats the whole NamespacePolicy struct (%#v), not just the name, so inspect it for the bad Name field.

Source

Thrown at acl/policy.go:571

		// Hot path for empty rules
		return p, nil
	}

	// Attempt to parse
	if err := hclDecode(p, rules); err != nil {
		return nil, fmt.Errorf("Failed to parse ACL Policy: %v", err)
	}

	// At least one valid policy must be specified, we don't want to store only
	// raw data
	if p.IsEmpty() {
		return nil, fmt.Errorf("Invalid policy: %s", p.Raw)
	}

	// Validate the policy
	for _, ns := range p.Namespaces {
		if !validNamespace.MatchString(ns.Name) {
			return nil, fmt.Errorf("Invalid namespace name: %#v", ns)
		}
		if ns.Policy != "" && !isPolicyValid(ns.Policy) {
			return nil, fmt.Errorf("Invalid namespace policy: %#v", ns)
		}
		for _, cap := range ns.Capabilities {
			if !isNamespaceCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid namespace capability '%s': %#v", cap, ns)
			}
		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if ns.Policy != "" {
			extraCap := expandNamespacePolicy(ns.Policy)
			ns.Capabilities = append(ns.Capabilities, extraCap...)
		}

		// Expand implicit capabilities

View on GitHub (pinned to 482b49bf1a)

Solutions

Fix the namespace 'name' field in the policy to match ^[a-zA-Z0-9-*]{1,128}$ (letters, digits, hyphen, asterisk only)
Remove leading/trailing whitespace and any interpolation that renders empty
Shorten names to 128 characters or fewer
Run acl.Parse locally or 'nomad acl policy apply' against a dev agent to pre-validate before deployment

Example fix

// before
namespace "my_team" {
  policy = "write"
}
// after
namespace "my-team" {
  policy = "write"
}

Defensive patterns

Strategy: validation

Validate before calling

var validNamespace = regexp.MustCompile(`^[a-zA-Z0-9-*]{1,128}$`)
for _, ns := range policy.Namespaces {
    if !validNamespace.MatchString(ns.Name) {
        return fmt.Errorf("namespace %q does not match %s", ns.Name, validNamespace)
    }
}

Type guard

func hasValidNamespaceName(name string) bool {
    return len(name) >= 1 && len(name) <= 128 &&
        strings.IndexFunc(name, func(r rune) bool {
            return !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '*')
        }) == -1
}

Prevention

Validate namespace names against ^[a-zA-Z0-9-*]{1,128}$ in CI before applying policies
Trim whitespace and reject empty interpolations in policy templates
Keep a unit test that runs acl.Parse over all checked-in policy files

When it happens

Trigger: Calling acl.Parse (or the Nomad API 'acl/policy' create/update endpoint) with a policy containing namespace "name" values containing illegal characters (spaces, dots, underscores, slashes, uppercase-free symbols), an empty name, or a name longer than 128 characters.

Common situations: Hand-edited HCL policies with typos like name = "my_team" or "team.1"; templated policies interpolating an empty or whitespace variable into the namespace name; tooling generating policies from team names that contain dots or underscores; migrating policies across clusters with older/newer naming rules.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f5122046696108d6. Report an issue: GitHub.