hashicorp/nomad · error

only paths at "nomad/jobs" or "nomad/job-templates" and belo

Error message

only paths at "nomad/jobs" or "nomad/job-templates" and below are valid paths under the top-level "nomad" directory

What it means

ValidatePath catch-all guard: the path falls under the top-level "nomad" directory but is not one of the permitted subtrees (nomad/jobs, nomad/sentinel, or nomad/job-templates/<name>), so it is rejected.

Source

Thrown at nomad/structs/variables.go:444

	// Don't allow a variable with path "nomad"
	if len(parts) == 1 {
		return fmt.Errorf(`"nomad" is a reserved top-level directory path, but you may write variables to "nomad/jobs", "nomad/job-templates", "nomad/sentinel", or below`)
	}

	switch {
	case parts[1] == "jobs" || parts[1] == "sentinel":
		// Any path including "nomad/jobs" or "nomad/sentinel" is valid
		return nil
	case parts[1] == "job-templates" && len(parts) == 3:
		// Paths including "nomad/job-templates" is valid, provided they have single further path part
		return nil
	case parts[1] == "job-templates":
		// Disallow exactly nomad/job-templates with no further paths
		return fmt.Errorf("\"nomad/job-templates\" is a reserved directory path, but you may write variables at the level below it, for example, \"nomad/job-templates/template-name\"")
	default:
		// Disallow arbitrary sub-paths beneath nomad/
		return fmt.Errorf("only paths at \"nomad/jobs\" or \"nomad/job-templates\" and below are valid paths under the top-level \"nomad\" directory")
	}
}

func (vd *VariableDecrypted) Canonicalize() {
	if vd.Namespace == "" {
		vd.Namespace = DefaultNamespace
	}

	if vd.Lock != nil {
		vd.Lock.Canonicalize()
	}
}

// Copy returns a fully hydrated copy of VariableMetadata that can be
// manipulated while ensuring the original is not touched.
func (sv *VariableMetadata) Copy() *VariableMetadata {
	if sv == nil {
		return nil

View on GitHub (pinned to 482b49bf1a)

Solutions

  1. Move the variable under "nomad/jobs/" or "nomad/job-templates/<name>"
  2. Use a top-level path outside "nomad" for user variables
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at nomad/structs/variables.go:444 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fecfe5e1c86619c8. Report an issue: GitHub.