hashicorp/nomad · error

Service with provider nomad cannot include Connect blocks

Error message

Service with provider nomad cannot include Connect blocks

What it means

validateNomadService checks each service whose provider is "nomad" and rejects any Connect block. Consul Connect (service mesh) features are only implemented through the Consul provider; native Nomad services cannot carry connect stanza definitions.

Source

Thrown at nomad/structs/services.go:924

// nomad provider.
func (s *Service) validateNomadService(mErr *multierror.Error) {
	// check checks
	for _, c := range s.Checks {
		// validate the check port
		if err := s.validateCheckPort(c); err != nil {
			mErr.Errors = append(mErr.Errors, err)
			continue
		}

		// validate the nomad check
		if err := c.validateNomad(); err != nil {
			mErr.Errors = append(mErr.Errors, err)
		}
	}

	// Services using the Nomad provider do not support Consul connect.
	if s.Connect != nil {
		mErr.Errors = append(mErr.Errors, errors.New("Service with provider nomad cannot include Connect blocks"))
	}
}

// validateIdentity performs validation on workload identity field populated by
// the job mutating hook
func (s *Service) validateIdentity() error {
	if s.Identity == nil {
		return nil
	}

	if len(s.Identity.Audience) == 0 {
		return fmt.Errorf("Service identity must provide at least one target aud value")
	}

	return nil
}

// ValidateName checks if the service Name is valid and should be called after

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the connect block from the service, or change the service provider back to "consul"
2. If mesh is not required, delete connect/sidecar stanzas and expose blocks tied to Connect
3. Use Nomad's native service discovery without Connect, or keep Consul for mesh-dependent services

Example fix

// before
service {
  name     = "web"
  provider = "nomad"
  connect { sidecar_service {} }
}
// after
service {
  name     = "web"
  provider = "nomad"
}

function validateNoConnectWithNomadProvider(services) {
  for (const s of services ?? []) {
    if ((s.provider ?? "consul") === "nomad" && s.connect) {
      throw new Error(`service ${s.name}: connect blocks require provider consul`);
    }
  }
}

function supportsConnect(s) { return (s.provider ?? "consul") === "consul"; }

try {
  await nomad.jobs.validate(job);
} catch (e) {
  if (e.message.includes("cannot include Connect blocks")) {
    console.error("Drop the connect stanza or revert provider to consul");
  } else throw e;
}

When it happens

Trigger: Submitting a job where a service has provider = "nomad" and a non-nil connect block (e.g. connect { sidecar_service {} } or a connect gateway stanza), during Validate.

Common situations: Migrating mesh-enabled services from Consul to Nomad provider without removing the connect stanza; job templates with connect sidecars that got their provider switched to nomad.

Related errors

• Connect proxy task must not have a service block
• timed out waiting for socket proxy to exit
• consul address must be set on nomad client
• error creating bootstrap configuration for Connect proxy sid
• non-default Consul cluster requires Nomad Enterprise

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1b355262a249b684. Report an issue: GitHub.