Service with provider nomad cannot include Connect blocks

Error message

Service with provider nomad cannot include Connect blocks

What it means

validateNomadService checks each service whose provider is "nomad" and rejects any Connect block. Consul Connect (service mesh) features are only implemented through the Consul provider; native Nomad services cannot carry connect stanza definitions.

Solutions

Remove the connect block from the service, or change the service provider back to "consul"
If mesh is not required, delete connect/sidecar stanzas and expose blocks tied to Connect
Use Nomad's native service discovery without Connect, or keep Consul for mesh-dependent services

Example fix

// before
service {
  name     = "web"
  provider = "nomad"
  connect { sidecar_service {} }
}
// after
service {
  name     = "web"
  provider = "nomad"
}

Defensive patterns

Strategy: validation

Validate before calling

function validateNoConnectWithNomadProvider(services) {
  for (const s of services ?? []) {
    if ((s.provider ?? "consul") === "nomad" && s.connect) {
      throw new Error(`service ${s.name}: connect blocks require provider consul`);
    }
  }
}

Type guard

function supportsConnect(s) { return (s.provider ?? "consul") === "consul"; }

Try / catch

try {
  await nomad.jobs.validate(job);
} catch (e) {
  if (e.message.includes("cannot include Connect blocks")) {
    console.error("Drop the connect stanza or revert provider to consul");
  } else throw e;
}

Prevention

Decide per-service whether it needs mesh; only mesh services should use consul provider + connect
Lint job files for provider/connect combinations
Document that nomad provider has no Connect support

When it happens

Trigger: Submitting a job where a service has provider = "nomad" and a non-nil connect block (e.g. connect { sidecar_service {} } or a connect gateway stanza), during Validate.

Common situations: Migrating mesh-enabled services from Consul to Nomad provider without removing the connect stanza; job templates with connect sidecars that got their provider switched to nomad.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1b355262a249b684. Report an issue: GitHub.

Appendix: source

Thrown at nomad/structs/services.go:924

// nomad provider.
func (s *Service) validateNomadService(mErr *multierror.Error) {
	// check checks
	for _, c := range s.Checks {
		// validate the check port
		if err := s.validateCheckPort(c); err != nil {
			mErr.Errors = append(mErr.Errors, err)
			continue
		}

		// validate the nomad check
		if err := c.validateNomad(); err != nil {
			mErr.Errors = append(mErr.Errors, err)
		}
	}

	// Services using the Nomad provider do not support Consul connect.
	if s.Connect != nil {
		mErr.Errors = append(mErr.Errors, errors.New("Service with provider nomad cannot include Connect blocks"))
	}
}

// validateIdentity performs validation on workload identity field populated by
// the job mutating hook
func (s *Service) validateIdentity() error {
	if s.Identity == nil {
		return nil
	}

	if len(s.Identity.Audience) == 0 {
		return fmt.Errorf("Service identity must provide at least one target aud value")
	}

	return nil
}

// ValidateName checks if the service Name is valid and should be called after

View on GitHub (pinned to 482b49bf1a)