hashicorp/nomad · error

mismatched request namespace in request: %q, %q

Error message

mismatched request namespace in request: %q, %q

What it means

In Nomad's job registration path (nomad/job_endpoint.go:128), the request-level namespace (args.RequestNamespace()) must match args.Job.Namespace. This is a defensive consistency check: the HTTP layer and RPC requester are expected to set both identically, and a mismatch indicates an inconsistent or forged request.

Source

Thrown at nomad/job_endpoint.go:128

	return j.doRegister(aclObj, allowedPermissions, args, reply)
}

// doRegister does the actual job registration, including any additional
// permission checks, and after metrics have begun recording
func (j *Job) doRegister(aclObj *acl.ACL, additionalAllowedPermissions []string, args *structs.JobRegisterRequest, reply *structs.JobRegisterResponse) error {
	if ok, err := registrationsAreAllowed(aclObj, j.srv.State()); !ok || err != nil {
		j.logger.Warn("job registration is currently disabled for non-management ACL")
		return structs.ErrJobRegistrationDisabled
	}

	// Validate the arguments
	if args.Job == nil {
		return fmt.Errorf("missing job for registration")
	}

	// defensive check; http layer and RPC requester should ensure namespaces are set consistently
	if args.RequestNamespace() != args.Job.Namespace {
		return fmt.Errorf("mismatched request namespace in request: %q, %q", args.RequestNamespace(), args.Job.Namespace)
	}

	// Run admission controllers
	job, warnings, err := j.admissionControllers(args.Job)
	if err != nil {
		return err
	}
	args.Job = job

	// Run the submission controller
	warnings = append(warnings, j.submissionController(args))

	// Attach the user token's accessor ID so that deploymentwatcher can
	// reference the token later in multiregion deployments. We can't auth once
	// and then use the leader ACL because the leader ACLs aren't shared across
	// regions. Note this implies WIs can't be used to register multi-region
	// jobs b/c their identities are only valid in a single region.
	if args.GetIdentity().ACLToken != nil &&

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Make the Job.Namespace field match the request namespace: either remove the namespace stanza from the job (inherits the request namespace) or set both to the same value.
2. If using the HTTP API, ensure the ?namespace= query parameter matches the job's namespace stanza.
3. Fix automation/tooling that injects the namespace into only one of the two places.
4. Prefer the CLI (`nomad job run -namespace=X`) which sets both consistently.

Example fix

// before (HCL with URL namespace=default)
nomad job run -namespace=default app.nomad  # job HCL contains: namespace = "prod"

// after
nomad job run -namespace=prod app.nomad  // or drop 'namespace' from the HCL

if job.Namespace != nil && req.Namespace != "" && *job.Namespace != req.Namespace {
	return fmt.Errorf("request namespace %q != job namespace %q", req.Namespace, *job.Namespace)
}

func namespacesMatch(reqNS string, jobNS *string) bool {
	if jobNS == nil || *jobNS == "" {
		return reqNS == "" || reqNS == structs.DefaultNamespace
	}
	return reqNS == "" || reqNS == *jobNS
}

_, _, err := client.Jobs().RegisterInNamespace(job, ns)
if err != nil && strings.Contains(err.Error(), "mismatched request namespace") {
	return fmt.Errorf("job stanza namespace must equal ?namespace= query param: %w", err)
}

When it happens

Trigger: Sending a JobRegister request where the WriteRequest.Namespace (or query parameter ?namespace=) differs from the Namespace field set inside the Job object being registered.

Common situations: Templates or scripts that set the namespace only on the job spec while the API call defaults to the 'default' namespace (or vice versa); passing ?namespace=prod in the URL while the HCL job contains namespace = "dev"; wrappers that mutate one but not the other.

Related errors

• volume validation failed: no such namespace %q
• missing job for registration
• must specify at least one namespace
• Invalid namespace %q: %v
• namespace %q using non-existent quota %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6f098c36bca42b9d. Report an issue: GitHub.