hashicorp/nomad · error

unexpected SupportedProxies response format from Consul

Error message

unexpected SupportedProxies response format from Consul

What it means

Proxies() in command/agent/consul/connect_proxies.go queries Consul's SupportedProxies endpoint via the agent's Consul client. The Consul HTTP API is expected to return a JSON object (map[string]any) of supported proxy kinds; if the decoded response is not a map, Nomad cannot convert it to its result type and returns this error. It almost always indicates the Consul agent responded with an unexpected or non-object payload rather than the documented schema.

Source

Thrown at command/agent/consul/connect_proxies.go:71

	// For these cases, we can simply fallback to the old version of Envoy
	// that Nomad defaulted to back then - but not in this logic. Instead,
	// return nil so we can choose what to do at the caller.

	xds, xdsExists := self["xDS"]
	if !xdsExists {
		return nil, nil
	}

	proxies, proxiesExists := xds["SupportedProxies"]
	if !proxiesExists {
		return nil, nil
	}

	// convert interface{} to map[string]interface{}

	intermediate, ok := proxies.(map[string]any)
	if !ok {
		return nil, errors.New("unexpected SupportedProxies response format from Consul")
	}

	// convert map[string]interface{} to map[string][]string

	result := make(map[string][]string, len(intermediate))
	for k, v := range intermediate {

		// convert interface{} to []interface{}

		if si, ok := v.([]any); ok {
			ss := make([]string, 0, len(si))
			for _, z := range si {

				// convert interface{} to string

				if s, ok := z.(string); ok {
					ss = append(ss, s)
				}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the Consul agent version supports the SupportedProxies connect endpoint (Consul >= 1.x with connect enabled); upgrade Consul if it is old.
2. Check that the Nomad agent's consul.address points at a genuine Consul server, not a proxy or mock, and inspect the raw response with `curl http://<consul>/v1/agent/connect/proxies/...`.
3. Confirm Consul connect is enabled (`connect.enabled = true` in the Consul agent config) so the endpoint returns the documented object rather than an error payload.
4. Inspect Nomad server logs for the underlying Consul HTTP status; if Consul returned 404/50x, fix routing/auth before retrying.

Example fix

// before: querying against Consul 1.2 without connect support
// after: run a compatible Consul agent
// consul.hcl
connect { enabled = true }

// verify Consul connect endpoint first
resp, _ := http.Get(consulAddr + "/v1/agent/connect/proxies/...")
var raw any
json.NewDecoder(resp.Body).Decode(&raw)
if _, ok := raw.(map[string]any); !ok {
    // abort: Consul version/build does not return the documented object
}

func isProxyMap(v any) bool {
    _, ok := v.(map[string]any)
    return ok
}

if err := proxiesCall(); err != nil {
    if strings.Contains(err.Error(), "unexpected SupportedProxies response format") {
        log.Printf("Consul version/connect mismatch, skipping proxy support query: %v", err)
        return fallbackProxyList
    }
    return err
}

When it happens

Trigger: Calling Nomad's Proxies API path when the Consul agent behind the query returns a JSON array, string, or null for the SupportedProxies endpoint — e.g. an old or non-standard Consul version, a proxy/middlebox rewriting the response, or a custom/modified Consul build.

Common situations: Running Nomad against an outdated Consul version that predates the SupportedProxies endpoint (Consul may return an error body or different shape), pointing Nomad at a service-discovery shim instead of real Consul, or a load balancer returning an HTML/JSON error page that decodes to a non-map value.

Related errors

• no one-time token returned
• no ACL token returned
• errMissingACLRoleID
• errMissingACLAuthMethodName
• errMissingACLBindingRuleID

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/90bc769cb1197926. Report an issue: GitHub.