{"record":{"id":"0976c891648188b4","repo":"hashicorp/nomad","slug":"using-env-t-without-change-mode-q-may-result-in","errorCode":null,"errorMessage":"using env=%t without change_mode=%q may result in task not getting updated identity","messagePattern":"using env=%t without change_mode=%q may result in task not getting updated identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"nomad/structs/workload_id.go","lineNumber":521,"sourceCode":"\t}\n\n\tvar mErr multierror.Error\n\n\tif n := len(wi.Audience); n == 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"identities without an audience are insecure\"))\n\t} else if n > 1 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"while multiple audiences is allowed, it is more secure to use 1 audience per identity\"))\n\t}\n\n\tif wi.Name != \"\" && wi.Name != WorkloadIdentityDefaultName {\n\t\tif wi.TTL == 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"identities without an expiration are insecure\"))\n\t\t}\n\t}\n\n\t// Warn users about using env vars without restarts\n\tif wi.Env && wi.ChangeMode != WIChangeModeRestart {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"using env=%t without change_mode=%q may result in task not getting updated identity\",\n\t\t\twi.Env, WIChangeModeRestart))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// WorkloadIdentityRequest encapsulates the 3 parameters used to generated a\n// signed workload identity: the alloc, task, and specific identity's name.\ntype WorkloadIdentityRequest struct {\n\tAllocID string\n\tWIHandle\n}\n\n// SignedWorkloadIdentity is the response to a WorkloadIdentityRequest and\n// includes the JWT for the requested workload identity.\ntype SignedWorkloadIdentity struct {\n\tWorkloadIdentityRequest\n\tJWT        string","sourceCodeStart":503,"sourceCodeEnd":539,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L503-L539","documentation":"WorkloadIdentity.Warnings warns that an identity delivered via environment variables (env = true) with a change_mode other than \"restart\" may leave the task holding a stale identity: env vars are only re-read on restart, so signal/no-op rotation never refreshes them.","triggerScenarios":"Calling Warnings() on an identity where wi.Env == true and wi.ChangeMode != WIChangeModeRestart, e.g. identity { env = true change_mode = \"signal\" change_signal = \"SIGHUP\" } or env = true with change_mode omitted-not-restart.","commonSituations":"Enabling env delivery while choosing signal rotation for smoother updates; copying a file-delivery identity config and flipping env = true without changing change_mode; template-generated jobs combining env=true with signal rotation.","solutions":["Set change_mode = \"restart\" so the task restarts and re-reads the updated env var.","Switch to file delivery (file = true, optionally filepath) which can be re-read in-process, keeping signal rotation.","Have the task re-exec or re-read its environment on the rotation signal if restarts are unacceptable."],"exampleFix":"// before\nidentity {\n  name = \"aws\"\n  env = true\n  change_mode = \"signal\"\n  change_signal = \"SIGHUP\"\n}\n// after\nidentity {\n  name = \"aws\"\n  env = true\n  change_mode = \"restart\"\n}","handlingStrategy":"validation","validationCode":"func validateEnvDelivery(wi *structs.WorkloadIdentity) error {\n  if wi.Env && wi.ChangeMode != structs.WIChangeModeRestart {\n    return fmt.Errorf(\"env=true identities must use change_mode=%q to refresh env vars\", structs.WIChangeModeRestart)\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair env = true only with change_mode = \"restart\" in templates.","Use file delivery when in-process rotation (signal) is required.","Test identity rotation end-to-end to confirm the task actually sees the new token."],"tags":["nomad","workload-identity","env-vars","rotation"],"backgroundTag":"stale-credentials","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}