hashicorp/nomad · error

Invalid node policy: %#v

Error message

Invalid node policy: %#v

What it means

acl.Parse (acl/policy.go:683) validates the top-level node block's Policy string with isPolicyValid, which only accepts deny, read, write, scale. Any other value fails parsing and rejects the whole policy. The offending NodePolicy struct is printed via %#v.

Source

Thrown at acl/policy.go:683

	// Now that we have processed all known keys, return an error if the
	// operator wrote a policy with unknown keys if we are being strict. While
	// these do not grant any extra privileges, it can be misleaing to allow
	// these and cause problems later if we add new capabilities that collide
	// with the unknown keys.
	if len(p.ExtraKeysHCL) > 0 && strict {
		return nil, fmt.Errorf("Invalid or duplicate policy keys: %v",
			strings.Join(p.ExtraKeysHCL, ", "))
	}

	p.ExtraKeysHCL = nil

	if p.Agent != nil && !isPolicyValid(p.Agent.Policy) {
		return nil, fmt.Errorf("Invalid agent policy: %#v", p.Agent)
	}

	if p.Node != nil && !isPolicyValid(p.Node.Policy) {
		return nil, fmt.Errorf("Invalid node policy: %#v", p.Node)
	}

	if p.Operator != nil {
		if p.Operator.Policy != "" && !isPolicyValid(p.Operator.Policy) {
			return nil, fmt.Errorf("Invalid operator policy: %#v", p.Operator)
		}
		for _, cap := range p.Operator.Capabilities {
			if !isOperatorCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid operator capability '%s'", cap)
			}
		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if p.Operator.Policy != "" {
			extraCap := expandOperatorPolicy(p.Operator.Policy)
			p.Operator.Capabilities = append(p.Operator.Capabilities, extraCap...)
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set the node block's policy to exactly one of: deny, read, write, scale (lowercase).
2. If fine-grained node permissions are needed, ensure you are on a Nomad version supporting node capabilities and use those instead.
3. Check the %#v struct printed in the error to confirm the offending value.

Example fix

// before
node {
  policy = "sudo"
}
// after
node {
  policy = "write"
}

if policy.Node != nil && policy.Node.Policy != "" &&
    !map[string]bool{"deny": true, "read": true, "write": true, "scale": true}[policy.Node.Policy] {
    return fmt.Errorf("node policy %q must be deny|read|write|scale", policy.Node.Policy)
}

func isPolicyValid(policy string) bool {
    switch policy {
    case "deny", "read", "write", "scale":
        return true
    }
    return false
}

_, err := acl.Parse(rules, acl.PolicyParseStrict)
if err != nil {
    if strings.Contains(err.Error(), "Invalid node policy") {
        // correct the node block's policy to a valid shorthand
    }
    return err
}

When it happens

Trigger: acl.Parse on a policy containing node { policy = "<invalid>" } where the value is not exactly "deny", "read", "write", or "scale" — e.g. 'list', 'sudo', or a case-mismatched 'Read'.

Common situations: Legacy Nomad policies or hand-written policies using pre-0.8 style values; copying the client 'enabled' concept into policy; tooling that fills the policy from a dropdown with wrong values.

Related errors

• Invalid namespace name: %#v
• Invalid namespace policy: %#v
• Invalid namespace capability '%s': %#v
• Invalid variable policy: no variable paths in namespace %s
• Invalid missing variable path in namespace %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/61b61c4133436ff8. Report an issue: GitHub.