success_before_passing may only be set for Consul service ch

Error message

success_before_passing may only be set for Consul service checks

What it means

Service check validation in validateNomad: success_before_passing was set to a non-zero value on a Nomad-native check; this Consul-only tuning field (delaying healthy status) is not supported for Nomad checks.

Source

Thrown at nomad/structs/services.go:390

		if sc.CheckRestart.IgnoreWarnings {
			return errors.New("ignore_warnings on check_restart only supported for Consul service checks")
		}
	}

	// address_mode="driver" not yet supported on nomad
	if sc.AddressMode == "driver" {
		return errors.New("address_mode = driver may only be set for Consul service checks")
	}

	if sc.Type == "http" {
		if sc.Method != "" && !helper.IsMethodHTTP(sc.Method) {
			return fmt.Errorf("method type %q not supported in Nomad http check", sc.Method)
		}
	}

	// success_before_passing is consul only
	if sc.SuccessBeforePassing != 0 {
		return errors.New("success_before_passing may only be set for Consul service checks")
	}

	// failures_before_critical is consul only
	if sc.FailuresBeforeCritical != 0 {
		return errors.New("failures_before_critical may only be set for Consul service checks")
	}

	// failures_before_warning is consul only
	if sc.FailuresBeforeWarning != 0 {
		return errors.New("failures_before_warning may only be set for Consul service checks")
	}

	// tls_server_name is consul only
	if sc.TLSServerName != "" {
		return errors.New("tls_server_name may only be set for Consul service checks")
	}

	return nil

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove success_before_passing from the check
Move the service to provider = "consul" if the feature is required
Rely on interval/timeout tuning instead for nomad checks

Example fix

// before
check {
  success_before_passing = 3
}
// after
check {
  interval = "10s"
  timeout  = "2s"
}

Defensive patterns

Strategy: validation

Validate before calling

if check.SuccessBeforePassing != 0 && service.Provider != "consul" {
    return fmt.Errorf("check %q: success_before_passing requires consul provider", check.Name)
}

Try / catch

if err := job.Validate(); err != nil {
    if strings.Contains(err.Error(), "success_before_passing") {
        // remove the field or move service to consul
    }
}

Prevention

Keep consul-only pass/fail tuning out of nomad check stanzas
Split shared templates by provider
Run nomad job validate in CI

When it happens

Trigger: Setting success_before_passing to a nonzero number on a check of a non-Consul service.

Common situations: Porting Consul health-check tuning to Nomad; flattening shared check templates across consul/nomad providers.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/22078c58c9f3c6b1. Report an issue: GitHub.