hashicorp/nomad · error

Invalid node pool policy '%s' for '%s'

Error message

Invalid node pool policy '%s' for '%s'

What it means

Returned by acl.Parse in acl/policy.go:625 when a node_pool stanza's policy shorthand is non-empty but not one of deny, read, write, or scale per isPolicyValid. Note the valid set for node pools in this check mirrors namespaces; the second %s in the message names the offending pool.

Source

Thrown at acl/policy.go:625

						return nil, fmt.Errorf(
							"Invalid variable capability '%s' in namespace %s", cap, ns.Name)
					}
				}
				pathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)

			}
		}

		// Remove the namespace name from the extra key list.
		p.removeExtraKey(ns.Name)
	}

	for _, np := range p.NodePools {
		if !validNodePool.MatchString(np.Name) {
			return nil, fmt.Errorf("Invalid node pool name '%s'", np.Name)
		}
		if np.Policy != "" && !isPolicyValid(np.Policy) {
			return nil, fmt.Errorf("Invalid node pool policy '%s' for '%s'", np.Policy, np.Name)
		}
		for _, cap := range np.Capabilities {
			if !isNodePoolCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid node pool capability '%s' for '%s'", cap, np.Name)
			}
		}

		if np.Policy != "" {
			extraCap := expandNodePoolPolicy(np.Policy)
			np.Capabilities = append(np.Capabilities, extraCap...)
		}

		// Remove the node-pool name from the extra key list.
		p.removeExtraKey(np.Name)
	}

	for _, hv := range p.HostVolumes {
		if !validVolume.MatchString(hv.Name) {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set policy to one of: deny, read, write, scale (exact lowercase)
2. Use explicit capabilities = ["read", "write", "delete", "deny"] instead of shorthand if fine-grained control is needed
3. Verify against the Nomad version's supported node-pool policy keywords

Example fix

// before
node_pool "prod" {
  policy = "admin"
}
// after
node_pool "prod" {
  policy = "write"
}

var validPoolPolicies = map[string]bool{"deny": true, "read": true, "write": true, "scale": true}
for _, np := range policy.NodePools {
    if np.Policy != "" && !validPoolPolicies[np.Policy] {
        return fmt.Errorf("node pool %s: policy %q not in deny|read|write|scale", np.Name, np.Policy)
    }
}

When it happens

Trigger: Calling acl.Parse with node_pool { policy = "..." } set to a value outside {deny, read, write, scale} — e.g. "list", "rw", "admin", or wrong-case variants.

Common situations: Copy-pasting policy words from other stanza types or other HashiCorp products; typos like 'wrtie'; assuming plugin-style 'list' policy applies to node pools (it does not); older Nomad versions lacking 'scale'.

Related errors

• Invalid node pool name '%s'
• Invalid namespace name: %#v
• Invalid namespace policy: %#v
• Invalid namespace capability '%s': %#v
• Invalid variable policy: no variable paths in namespace %s

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/77c12f1d916f822e. Report an issue: GitHub.