{"record":{"id":"06e638b48c62ca70","repo":"hashicorp/nomad","slug":"vault-validation-failed-v","errorCode":null,"errorMessage":"Vault validation failed: %v","messagePattern":"Vault validation failed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":8327,"sourceCode":"\t}\n\n\t// Validate Services\n\tif err := validateServices(t, tg.Networks); err != nil {\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\t// Validate artifacts.\n\tfor idx, artifact := range t.Artifacts {\n\t\tif err := artifact.Validate(); err != nil {\n\t\t\touter := fmt.Errorf(\"Artifact %d validation failed: %v\", idx+1, err)\n\t\t\tmErr.Errors = append(mErr.Errors, outer)\n\t\t}\n\t}\n\n\t// Validate Vault.\n\tif t.Vault != nil {\n\t\tif err := t.Vault.Validate(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Vault validation failed: %v\", err))\n\t\t}\n\t}\n\n\t// Validate templates.\n\tdestinations := make(map[string]int, len(t.Templates))\n\tfor idx, tmpl := range t.Templates {\n\t\tif err := tmpl.Validate(); err != nil {\n\t\t\touter := fmt.Errorf(\"Template %d validation failed: %s\", idx+1, err)\n\t\t\tmErr.Errors = append(mErr.Errors, outer)\n\t\t}\n\n\t\tif other, ok := destinations[tmpl.DestPath]; ok {\n\t\t\touter := fmt.Errorf(\"Template %d has same destination as %d\", idx+1, other)\n\t\t\tmErr.Errors = append(mErr.Errors, outer)\n\t\t} else {\n\t\t\tdestinations[tmpl.DestPath] = idx + 1\n\t\t}\n\t}","sourceCodeStart":8309,"sourceCodeEnd":8345,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L8309-L8345","documentation":"Raised in Task validation (nomad/structs/structs.go:8327) when the task's Vault block is present and Vault.Validate() fails. Vault policies in Nomad must be valid names (e.g. non-empty, no invalid characters); this error wraps the underlying cause for the submitted job's vault stanza.","triggerScenarios":"task { vault { policies = [...] } } with an empty or malformed policy name (invalid characters, missing value) in the policies list; job submission over CLI or API triggers validation.","commonSituations":"Users typo policy names or leave policies = [] expecting defaults; jobs templated from scripts interpolating an empty policy variable; environment where Vault integration changed and policy naming rules tightened.","solutions":["Read the wrapped inner error to see the exact policy problem.","Ensure every entry in vault.policies is a non-empty, valid policy name (alphanumeric, dashes, etc.).","Remove the vault block if the task does not need Vault tokens.","Verify the policies exist in Vault (nomad job validate will surface integration errors too)."],"exampleFix":"// before\nvault {\n  policies = [\"${vault_policy}\"]  // interpolates to empty\n}\n// after\nvault {\n  policies = [\"my-app-policy\"]\n}","handlingStrategy":"validation","validationCode":"if t.Vault != nil {\n  for _, p := range t.Vault.Policies {\n    if p == \"\" || strings.ContainsAny(p, \" \\t/\") {\n      return fmt.Errorf(\"invalid vault policy name %q\", p)\n    }\n  }\n}","typeGuard":"func validVaultPolicies(ps []string) bool {\n  for _, p := range ps {\n    if p == \"\" || strings.ContainsAny(p, \" \\t/\") { return false }\n  }\n  return len(ps) > 0\n}","tryCatchPattern":null,"preventionTips":["Avoid interpolating policy names from possibly-empty variables.","Confirm each policy exists in Vault before referencing it.","Remove the vault block when a task needs no secrets."],"tags":["nomad","validation","vault","job-spec"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}