used group network modes %q are not allowed in namespace %q

Error message

used group network modes %q are not allowed in namespace %q

What it means

Plural counterpart of the single disallowed network mode error: raised when two or more group network modes in the job are not allowed by the namespace policy. The message lists all offending modes via Go %q of a slice plus the namespace name.

Source

Thrown at nomad/job_endpoint_validators.go:67

		}
	}

	var disallowedNetworkModes []string
	for _, tg := range job.TaskGroups {
		for _, network := range tg.Networks {
			if allowed, network_mode := taskValidateNetworkMode(network, ns); !allowed {
				disallowedNetworkModes = append(disallowedNetworkModes, network_mode)
			}
		}
	}
	if len(disallowedNetworkModes) > 0 {
		if len(disallowedNetworkModes) == 1 {
			return nil, fmt.Errorf(
				"used group network mode %q is not allowed in namespace %q", disallowedNetworkModes[0], ns.Name,
			)

		} else {
			return nil, fmt.Errorf(
				"used group network modes %q are not allowed in namespace %q", disallowedNetworkModes, ns.Name,
			)
		}
	}

	return nil, nil
}

func taskValidateNetworkMode(network *structs.NetworkResource, ns *structs.Namespace) (bool, string) {
	network_mode := "host"
	if len(network.Mode) > 0 {
		network_mode = network.Mode
	}
	if ns.Capabilities == nil {
		return true, network_mode
	}
	allow := len(ns.Capabilities.EnabledNetworkModes) == 0
	if slices.Contains(ns.Capabilities.EnabledNetworkModes, network_mode) {

View on GitHub (pinned to 482b49bf1a)

Solutions

Rewrite the offending groups' network blocks to allowed modes
Extend the namespace's allowed network modes list
Split groups into different namespaces matching their network requirements

Example fix

// before
// groups use "host" and "cni/custom", namespace allows ["bridge"]
// after
nomad namespace apply -allow-network=host,cni/custom team
// or set all groups to network { mode = "bridge" }

Defensive patterns

Strategy: validation

Validate before calling

// before submit
ns, _ := client.Namespaces().Info(job.Namespace, nil)
var badModes []string
for _, tg := range job.TaskGroups {
  for _, n := range tg.Networks {
    if !networkModeAllowedInNamespace(ns, n.Mode) { badModes = append(badModes, n.Mode) }
  }
}
if len(badModes) > 0 { return fmt.Errorf("disallowed network modes: %v", badModes) }

Prevention

Standardize one network mode per namespace to avoid plural violations
Audit all task groups (not just the first) in pre-submit checks
Sync namespace network policy changes with dependent job templates

When it happens

Trigger: Registering a job where 2+ task groups use network modes disallowed by the namespace's network policy. Raised in Validate when len(disallowedNetworkModes) > 1.

Common situations: Multi-group jobs mixing host and cni modes in a bridge-only namespace; namespace policy changed after a heterogeneous job was already deployed; templates generating groups with varied network modes.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f49d9e45bfe723f8. Report an issue: GitHub.