hashicorp/nomad · error

unknown binding rule bind type: %s

Error message

unknown binding rule bind type: %s

What it means

computeBindName hits a BindType value it does not recognize after HIL interpolation. Only policy, role, and management bind types are supported; anything else returns this error, which Bind wraps as error 2010.

Source

Thrown at lib/auth/binder.go:159

// - If the HIL is invalid ("", false, AN_ERROR) is returned.
// - If the computed name is not valid for the type ("INVALID_NAME", false, nil) is returned.
// - If the computed name is valid for the type ("VALID_NAME", true, nil) is returned.
func computeBindName(bindType, bindName string, claimMappings map[string]string) (string, bool, error) {
	bindName, err := InterpolateHIL(bindName, claimMappings, true)
	if err != nil {
		return "", false, err
	}

	var valid bool
	switch bindType {
	case structs.ACLBindingRuleBindTypePolicy:
		valid = structs.ValidPolicyName.MatchString(bindName)
	case structs.ACLBindingRuleBindTypeRole:
		valid = structs.ValidACLRoleName.MatchString(bindName)
	case structs.ACLManagementToken:
		valid = true
	default:
		return "", false, fmt.Errorf("unknown binding rule bind type: %s", bindType)
	}

	return bindName, valid, nil
}

// doesSelectorMatch checks that a single selector matches the provided vars.
func doesSelectorMatch(selector string, selectableVars interface{}) bool {
	if selector == "" {
		return true // catch-all
	}

	eval, err := bexpr.CreateEvaluator(selector)
	if err != nil {
		return false // fails to match if selector is invalid
	}

	result, err := eval.Evaluate(selectableVars)
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. List the auth method's binding rules and correct the BindType to one of: policy, role, management
2. Delete the offending binding rule and recreate it via the official API
3. Ensure you use the SDK/API constants rather than hand-written strings

Example fix

// before
{"BindType": "roles", "BindName": "${team}"}
// after
{"BindType": "role", "BindName": "${team}"}

var validBindTypes = map[string]bool{"policy": true, "role": true, "management": true}
func bindTypeIsValid(t string) bool { return validBindTypes[t] }

if err != nil && strings.Contains(err.Error(), "unknown binding rule bind type") {
    return fmt.Errorf("binding rule misconfigured: %w", err)
}

When it happens

Trigger: An ACL binding rule persisted with an unknown/misspelled BindType value, or internal code passing structs.ACLManagementToken-style constants that no longer match the expected bind-type strings.

Common situations: Manual state edits or API writes with an invalid bind type; upgrading across versions where bind type constants changed; a typo like 'rol' or 'Management' (case mismatch) when creating binding rules.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• cannot compute %q bind name for bind target: %w
• computed %q bind name for bind target is invalid: %q
• no signed workload identity available
• JWT login returned an empty secret
• JWT login did not return a token

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b6411a7fe5ef2cac. Report an issue: GitHub.