hashicorp/nomad · error

Invalid plugin policy: %#v

Error message

Invalid plugin policy: %#v

What it means

This error is returned by acl/policy.go when a parsed ACL policy contains a `plugin` stanza that fails `p.Plugin.isValid()`. The plugin policy struct (PluginPolicy) is validated after HCL decoding, and an invalid one rejects the entire Policy. The %#v formatting dumps the Plugin struct for diagnosis.

Source

Thrown at acl/policy.go:727

			if !isSentinelCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid sentinel capability '%s'", cap)
			}
		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if p.Sentinel.Policy != "" {
			extraCap := expandSentinelPolicy(p.Sentinel.Policy)
			p.Sentinel.Capabilities = append(p.Sentinel.Capabilities, extraCap...)
		}
	}

	if p.Quota != nil && !isPolicyValid(p.Quota.Policy) {
		return nil, fmt.Errorf("Invalid quota policy: %#v", p.Quota)
	}

	if p.Plugin != nil && !p.Plugin.isValid() {
		return nil, fmt.Errorf("Invalid plugin policy: %#v", p.Plugin)
	}
	return p, nil
}

// hclDecode wraps hcl.Decode function but handles any unexpected panics
func hclDecode(p *Policy, rules string) (err error) {
	defer func() {
		if rerr := recover(); rerr != nil {
			err = fmt.Errorf("invalid acl policy: %v", rerr)
		}
	}()

	if err = hcl.Decode(p, rules); err != nil {
		return err
	}

	// Manually parse the policy to fix blocks without labels.
	//

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Correct the fields in the `plugin` stanza so PluginPolicy.isValid passes (required name and shard config present).
2. Remove the `plugin` stanza if plugin-level ACL restriction is not used.
3. Compare against a known-good example of plugin policy syntax from the Consul documentation.

Example fix

// before
plugin {
  name = ""
}
// after
plugin {
  name = "my-plugin"
  shard = "us-east-1"
}

// ensure plugin stanza has required fields before parse
if strings.Contains(rules, "plugin {") {
    if !regexp.MustCompile(`plugin\s*{\s*name\s*=\s*"[^"]+"`).MatchString(rules) {
        return fmt.Errorf("plugin stanza requires a non-empty name")
    }
}

When it happens

Trigger: Parsing ACL policy rules containing a `plugin { ... }` stanza whose fields (e.g. name/sharding rules) do not pass PluginPolicy.isValid — such as a missing or empty required field.

Common situations: Enterprising users writing plugin ACL policies by hand; truncated templated policy files; upgrading from versions with different PluginPolicy requirements.

Related errors

• Invalid quota policy: %#v
• invalid acl policy: %v
• failed to parse policy: %w
• no one-time token returned
• no ACL token returned

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/76c08d1026ad6dc7. Report an issue: GitHub.