success_before_passing not supported for check of type %q

Error message

success_before_passing not supported for check of type %q

What it means

Nomad's Consul service check validation rejects setting success_before_passing on check types that do not support pass/fail semantics. Only tcp, http, and grpc checks may use it. The error names the offending check type.

Source

Thrown at nomad/structs/services.go:444

		// We can however immediately ensure expose is configured only for HTTP
		// and gRPC checks.
		switch checkType {
		case ServiceCheckGRPC, ServiceCheckHTTP: // ok
		default:
			return fmt.Errorf("expose may only be set on HTTP or gRPC checks")
		}
	}

	// passFailCheckTypes are intersection of check types supported by both Consul
	// and Nomad when using the pass/fail check threshold features.
	//
	// Consul only.
	passFailCheckTypes := []string{"tcp", "http", "grpc"}

	if sc.SuccessBeforePassing < 0 {
		return fmt.Errorf("success_before_passing must be non-negative")
	} else if sc.SuccessBeforePassing > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("success_before_passing not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeCritical < 0 {
		return fmt.Errorf("failures_before_critical must be non-negative")
	} else if sc.FailuresBeforeCritical > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_critical not supported for check of type %q", sc.Type)
	}

	if sc.FailuresBeforeWarning < 0 {
		return fmt.Errorf("failures_before_warning must be non-negative")
	} else if sc.FailuresBeforeWarning > 0 && !slices.Contains(passFailCheckTypes, sc.Type) {
		return fmt.Errorf("failures_before_warning not supported for check of type %q", sc.Type)
	}

	// Arbitrary value, we could bump it if needed
	if len(sc.Notes) > 255 {
		return fmt.Errorf("notes must not be longer than 255 characters")
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove success_before_passing from checks whose type is not tcp/http/grpc
Change the check type to tcp, http, or grpc if pass/fail gating is desired
Set success_before_passing to 0 to disable the feature

Example fix

// before
check {
  type = "script"
  success_before_passing = 3
}
// after
check {
  type = "http"
  success_before_passing = 3
}

Defensive patterns

Strategy: validation

Validate before calling

var passFail = []string{"tcp","http","grpc"}
if sc.SuccessBeforePassing > 0 && !slices.Contains(passFail, sc.Type) {
    return fmt.Errorf("success_before_passing unsupported for type %q", sc.Type)
}

Type guard

func supportsPassFail(sc *ServiceCheck) bool {
    return slices.Contains([]string{"tcp","http","grpc"}, sc.Type)
}

Prevention

Only set success_before_passing on tcp/http/grpc checks
Validate job with nomad job validate before submission
Keep shared check templates split per check type

When it happens

Trigger: Setting ServiceRegistration or Service check field SuccessBeforePassing > 0 on a check whose Type is not tcp/http/grpc (e.g. script, ttl checks), then calling Validate on the service.

Common situations: Copying success_before_passing from an HTTP check block into a 'script' or 'ttl' check; typos in check type; templates generating checks with a default empty/unsupported type.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4526a03a6ae17ed5. Report an issue: GitHub.