{"record":{"id":"0a67baa0d6cdfae0","repo":"hashicorp/nomad","slug":"default-auth-config-text-could-not-be-deserialized-0a67ba","errorCode":null,"errorMessage":"default auth config text could not be deserialized: %v","messagePattern":"default auth config text could not be deserialized: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":504,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not create Vault policy: %w\", err)\n\t}\n\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created policy %q.\", vaultPolicyName))\n\n\treturn nil\n}\n\nfunc (s *SetupVaultCommand) authMethodExists() bool {\n\texistingConf, _ := s.vLogical.Read(fmt.Sprintf(\"/auth/%s/config\", vaultPath))\n\treturn existingConf != nil\n}\n\nfunc (s *SetupVaultCommand) renderAuthMethod() (map[string]any, error) {\n\tauthConfig := map[string]any{}\n\terr := json.Unmarshal(vaultAuthConfigBody, &authConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"default auth config text could not be deserialized: %v\", err)\n\t}\n\n\tauthConfig[\"jwks_url\"] = s.jwksURL\n\tauthConfig[\"default_role\"] = vaultRole\n\n\tif s.jwksCACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(s.jwksCACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n\t\t}\n\t\tauthConfig[\"jwks_ca_pem\"] = string(caCert)\n\t}\n\n\treturn authConfig, nil\n}\n\nfunc (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {\n\terr := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: \"jwt\"})","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L486-L522","documentation":"renderAuthMethod deserializes the embedded default JWT auth config (vaultAuthConfigBody) into a map. This error means the compiled-in JSON constant itself failed to unmarshal — a build-time asset problem, not user input.","triggerScenarios":"json.Unmarshal(vaultAuthConfigBody, &authConfig) fails because the embedded JSON constant is malformed (e.g. broken during code generation or an edit).","commonSituations":"Patched or incorrectly generated binary where the embedded config string was corrupted; virtually never caused by runtime user configuration.","solutions":["Rebuild nomad-setup from a clean checkout so the embedded JSON constant is intact","Validate the vaultAuthConfigBody constant with a JSON linter or go test","Avoid hand-editing embedded JSON assets in the source"],"exampleFix":"// before (embedded constant edited by hand)\nconst vaultAuthConfigBody = `{\"jwks_url\": \"\", \"default_role\": \"\",}`\n// after\nconst vaultAuthConfigBody = `{\"jwks_url\": \"\", \"default_role\": \"\"}`","handlingStrategy":"validation","validationCode":"var probe map[string]any\nif err := json.Unmarshal(vaultAuthConfigBody, &probe); err != nil {\n    // embedded config constant is corrupt; rebuild binary\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit embedded JSON constants","Add a go test that unmarshals all embedded config constants","Rebuild from a clean checkout if this error appears"],"tags":["go","json","embedded-config","unmarshal"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}