hashicorp/nomad · error

Invalid quota policy: %#v

Error message

Invalid quota policy: %#v

What it means

This error is returned by acl/policy.go when parsing an ACL policy whose `quota` stanza contains a policy string that fails `isPolicyValid`. The quota policy is validated against an allowlist of valid quota specification formats before the Policy object is accepted. It wraps the whole %#v representation of the Quota struct so the developer can see which quota definition was rejected.

Source

Thrown at acl/policy.go:723

		if p.Sentinel.Policy != "" && !isPolicyValid(p.Sentinel.Policy) {
			return nil, fmt.Errorf("Invalid sentinel policy: %#v", p.Sentinel)
		}
		for _, cap := range p.Sentinel.Capabilities {
			if !isSentinelCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid sentinel capability '%s'", cap)
			}
		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if p.Sentinel.Policy != "" {
			extraCap := expandSentinelPolicy(p.Sentinel.Policy)
			p.Sentinel.Capabilities = append(p.Sentinel.Capabilities, extraCap...)
		}
	}

	if p.Quota != nil && !isPolicyValid(p.Quota.Policy) {
		return nil, fmt.Errorf("Invalid quota policy: %#v", p.Quota)
	}

	if p.Plugin != nil && !p.Plugin.isValid() {
		return nil, fmt.Errorf("Invalid plugin policy: %#v", p.Plugin)
	}
	return p, nil
}

// hclDecode wraps hcl.Decode function but handles any unexpected panics
func hclDecode(p *Policy, rules string) (err error) {
	defer func() {
		if rerr := recover(); rerr != nil {
			err = fmt.Errorf("invalid acl policy: %v", rerr)
		}
	}()

	if err = hcl.Decode(p, rules); err != nil {
		return err

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the `policy` value inside the `quota` stanza so it matches a valid quota policy format expected by isPolicyValid.
2. Remove the `quota` stanza entirely if quota enforcement is not needed in this policy.
3. Check the input HCL for stray whitespace, empty assignment (`policy = ""`), or encoding issues introduced by templating.

Example fix

// before
quota {
  policy = ""
}
// after
quota {
  policy = "quota-default-10"
}

// validate quota stanza before parsing
if strings.Contains(rules, "quota {") {
    m := regexp.MustCompile(`policy\s*=\s*"([^"]*)"`).FindStringSubmatch(rules)
    if len(m) < 2 || m[1] == "" {
        return fmt.Errorf("quota policy must be a non-empty valid policy string")
    }
}

When it happens

Trigger: Calling acl.NewPolicy / policy parsing (e.g. from the Consul agent or `consul acl policy` update) with rules containing a `quota { policy = "..." }` stanza whose policy value is not in the valid quota policy set (empty string or malformed quota spec).

Common situations: Hand-written ACL policy HCL with a typo'd or empty quota policy string; copying policy snippets from docs for an older Consul version; automation templates leaving the quota policy field blank.

Related errors

• Invalid plugin policy: %#v
• invalid acl policy: %v
• failed to parse policy: %w
• no one-time token returned
• no ACL token returned

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5915ea0bb0a5053e. Report an issue: GitHub.