hashicorp/nomad · error

unsupported bind type: %q

Error message

unsupported bind type: %q

What it means

ACLBindingRule.Validate() only accepts known BindType values (e.g. "field" selector-based bind and "management"); anything else falls into the default branch and is rejected as an unsupported bind type. The offending value is quoted in the error to ease diagnosis.

Source

Thrown at nomad/structs/acl.go:2108

		mErr.Errors = append(mErr.Errors, fmt.Errorf("description longer than %d", maxACLRoleDescriptionLength))
	}

	// Depending on the bind type, we have some specific validation. Catching
	// the empty string also provides easier to understand feedback to the
	// user.
	switch a.BindType {
	case "":
		mErr.Errors = append(mErr.Errors, errors.New("bind type is missing"))
	case ACLBindingRuleBindTypeRole, ACLBindingRuleBindTypePolicy:
		if a.BindName == "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name is missing"))
		}
	case ACLBindingRuleBindTypeManagement:
		if a.BindName != "" {
			mErr.Errors = append(mErr.Errors, errors.New("bind name should be empty"))
		}
	default:
		mErr.Errors = append(mErr.Errors, fmt.Errorf("unsupported bind type: %q", a.BindType))
	}

	// If there is a selector configured, ensure that go-bexpr can parse this.
	// Otherwise, the user will get an ambiguous failure when attempting to
	// login.
	if a.Selector != "" {
		if _, err := bexpr.CreateEvaluator(a.Selector, nil); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("selector is invalid: %v", err))
		}
	}

	return mErr.ErrorOrNil()
}

// Merge merges binding rule a with b. It sets all required empty fields of rule
// a to corresponding values of rule b, except for "ID" which must be provided.
func (a *ACLBindingRule) Merge(b *ACLBindingRule) {
	a.BindName = helper.Merge(a.BindName, b.BindName)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set bind_type to a supported value, e.g. "management" or the selector/field bind type used by your Nomad version.
2. Check spelling and casing of the value.
3. If bind_type is omitted, set it explicitly rather than sending an empty string.

Example fix

// before
bind_type = "policy"

// after
bind_type = "management"

var validBindTypes = map[string]bool{"management": true, "field": true}
if !validBindTypes[rule.BindType] {
    return fmt.Errorf("bind_type %q unsupported", rule.BindType)
}

func isValidBindType(s string) bool {
    return s == "management" || s == "field"
}

When it happens

Trigger: Submitting an ACL binding rule whose BindType is empty or set to an unknown string like "role", "policy", or a mis-cased value instead of a supported ACLBindingRuleBindType constant.

Common situations: Typo in bind_type; copying examples from Consul (which has different bind types); forgetting to set bind_type at all (empty string hits default); older API clients sending legacy values.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• bind name should be empty
• invalid KeySource %q
• selector is invalid: %v
• errMissingACLBindingRuleID
• token name too long

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c2d2e438e1304524. Report an issue: GitHub.