hashicorp/nomad · error

Service on_update must be %q, %q, or %q; not %q

Error message

Service on_update must be %q, %q, or %q; not %q

What it means

In Service.Validate, the on_update field did not match any allowed value (require_healthy, ignore_warnings). It fires from the switch validating update behavior for service registrations during deployments.

Source

Thrown at nomad/structs/services.go:788

		// Log actual service name, not the stripped version.
		mErr.Errors = append(mErr.Errors, fmt.Errorf("%v: %q", err, s.Name))
	}

	switch s.AddressMode {
	case "", AddressModeAuto:
	case AddressModeHost, AddressModeDriver, AddressModeAlloc, AddressModeAllocIPv6:
		if s.Address != "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Service address_mode must be %q if address is set", AddressModeAuto))
		}
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("Service address_mode must be %q, %q, or %q; not %q", AddressModeAuto, AddressModeHost, AddressModeDriver, s.AddressMode))
	}

	switch s.OnUpdate {
	case "", OnUpdateIgnore, OnUpdateRequireHealthy, OnUpdateIgnoreWarn:
		// OK
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("Service on_update must be %q, %q, or %q; not %q", OnUpdateRequireHealthy, OnUpdateIgnoreWarn, OnUpdateIgnore, s.OnUpdate))
	}

	// Up until this point, all service validation has been independent of the
	// provider. From this point on, we have different validation paths. We can
	// also catch an incorrect provider parameter.
	switch s.Provider {
	case ServiceProviderConsul:
		s.validateConsulService(&mErr)
	case ServiceProviderNomad:
		s.validateNomadService(&mErr)
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("Service provider must be %q, or %q; not %q",
			ServiceProviderConsul, ServiceProviderNomad, s.Provider))
	}

	if err := s.validateIdentity(); err != nil {
		mErr.Errors = append(mErr.Errors, err)
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use one of: ignore, require_healthy, ignore_warn
2. Omit on_update to accept the default require_healthy
3. Fix the typo in the on_update value

Example fix

// before
on_update = "require_healthy"
// after
on_update = "require_healthy" # valid; invalid example was on_update = "healthy"

var onUpdate = []string{"","ignore","require_healthy","ignore_warn"}
if !slices.Contains(onUpdate, s.OnUpdate) {
    return fmt.Errorf("invalid on_update %q", s.OnUpdate)
}

When it happens

Trigger: Setting on_update to an unrecognized string (e.g. "healthy", "required") on a service and validating the job.

Common situations: Typos; copying Consul's similar-but-different keywords; pre-1.x configs written before on_update existed.

Related errors

• missing secret ID
• namespace cannot contain template delimiters or parenthesis
• wait config is nil or empty
• CSI.ControllerAttachVolume: VolumeID is required
• CSI.ControllerAttachVolume: ClientCSINodeID is required

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e4160dbf6f171298. Report an issue: GitHub.