hashicorp/nomad · error

namespace %q contains at least one variable. All variables i

Error message

namespace %q contains at least one variable. All variables in namespace must be deleted before it can be deleted

What it means

DeleteNamespace refuses deletion when any structured variables (Nomad's secret/config storage) exist under the namespace. Unlike jobs/volumes, the offending variable path is intentionally omitted from the message because the caller may lack List permission on variables in that namespace.

Source

Thrown at nomad/state/state_store.go:7168

		vIter, err := s.csiVolumesByNamespaceImpl(txn, nil, name, "")
		if err != nil {
			return err
		}
		rawVol := vIter.Next()
		if rawVol != nil {
			vol := rawVol.(*structs.CSIVolume)
			return fmt.Errorf("namespace %q contains at least one CSI volume %q. "+
				"All CSI volumes in namespace must be deleted before it can be deleted", name, vol.ID)
		}

		varIter, err := s.getVariablesByNamespaceImpl(txn, nil, name)
		if err != nil {
			return err
		}
		if varIter.Next() != nil {
			// unlike job/volume, don't show the path here because the user may
			// not have List permissions on the vars in this namespace
			return fmt.Errorf("namespace %q contains at least one variable. "+
				"All variables in namespace must be deleted before it can be deleted", name)
		}

		// Delete the namespace
		if err := txn.Delete(TableNamespaces, existing); err != nil {
			return fmt.Errorf("namespace deletion failed: %v", err)
		}
	}

	if err := txn.Insert("index", &IndexEntry{TableNamespaces, index}); err != nil {
		return fmt.Errorf("index update failed: %v", err)
	}

	return txn.Commit()
}

func (s *StateStore) DeleteScalingPolicies(index uint64, ids []string) error {
	txn := s.db.WriteTxn(index)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. List variables with sufficient ACL permissions (`nomad var list -namespace <ns>`) and delete them (`nomad var delete -namespace <ns> <path>`), then retry.
2. If access is denied, ask an operator with the variables:list/write ACL capability to clear the namespace's variables.
3. Recreate the namespace only after `nomad var list -namespace <ns>` returns empty.

Example fix

# before
nomad namespace delete app-team   # fails, reason hidden
# after
nomad var list -namespace app-team
nomad var delete -namespace app-team secret/app/config
nomad namespace delete app-team

vars, _, _ := client.Variables().List(&nomad.QueryOptions{Namespace: ns})
if len(vars) > 0 {
    return fmt.Errorf("%d variables remain in %s; delete them first", len(vars), ns)
}

if strings.Contains(err.Error(), "contains at least one variable") {
    // list vars with adequate ACLs, delete them, then retry
}

When it happens

Trigger: DELETE /v1/namespace/<name> while `nomad var` entries exist at paths under that namespace.

Common situations: Variables created by job deployments or CI pipelines left behind after workload removal; operators unable to discover which vars block deletion because paths are hidden.

Related errors

• variable doesn't exist
• variable doesn't hold a lock
• job %q is in nonexistent namespace %q
• namespace not found
• default namespace can not be deleted

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2490b71be41e6dbd. Report an issue: GitHub.