{"record":{"id":"0ca72aad4eced471","repo":"hashicorp/nomad","slug":"vault-cluster-q-is-disabled-or-not-configured","errorCode":null,"errorMessage":"Vault cluster %q is disabled or not configured","messagePattern":"Vault cluster %q is disabled or not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/template_hook.go","lineNumber":206,"sourceCode":"\tonce, watch := []*structs.Template{}, []*structs.Template{}\n\tfor _, tmpl := range h.config.templates {\n\t\tif tmpl.Once {\n\t\t\tonce = append(once, tmpl)\n\t\t} else {\n\t\t\twatch = append(watch, tmpl)\n\t\t}\n\t}\n\n\treturn h.renderTemplates(ctx, once, watch)\n}\n\nfunc (h *templateHook) newManager(tmpls []*structs.Template) (manager *template.TaskTemplateManager, unblock chan struct{}, err error) {\n\tvaultCluster := h.task.GetVaultClusterName()\n\tvaultConfig := h.config.clientConfig.GetVaultConfigs(h.logger)[vaultCluster]\n\n\t// Fail if task has a vault block but no client config was found.\n\tif h.task.Vault != nil && vaultConfig == nil {\n\t\treturn nil, nil, fmt.Errorf(\"Vault cluster %q is disabled or not configured\", vaultCluster)\n\t}\n\n\ttg := h.config.alloc.Job.LookupTaskGroup(h.config.alloc.TaskGroup)\n\tconsulCluster := h.task.GetConsulClusterName(tg)\n\tconsulConfig := h.config.clientConfig.GetConsulConfigs(h.logger)[consulCluster]\n\n\tunblock = make(chan struct{})\n\tm, err := template.NewTaskTemplateManager(&template.TaskTemplateManagerConfig{\n\t\tUnblockCh:            unblock,\n\t\tLifecycle:            h.config.lifecycle,\n\t\tEvents:               h.config.events,\n\t\tTemplates:            tmpls,\n\t\tClientConfig:         h.config.clientConfig,\n\t\tConsulNamespace:      h.config.consulNamespace,\n\t\tConsulToken:          h.consulToken,\n\t\tConsulConfig:         consulConfig,\n\t\tVaultToken:           h.vaultToken,\n\t\tVaultConfig:          vaultConfig,","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/template_hook.go#L188-L224","documentation":"In newManager, the template hook checks that if the task declares a vault block, the Nomad client actually has a Vault configuration for the resolved vault cluster name. If task.Vault is set but clientConfig.GetVaultConfigs(...)[vaultCluster] is nil, template rendering cannot proceed and this error is thrown.","triggerScenarios":"A task's vault block references a cluster whose name has no matching vault { cluster <name> { ... } } stanza in the Nomad client agent config, or vault is entirely unconfigured/disabled on the client.","commonSituations":"Multi-cluster Vault setups where the job's vault.cluster value doesn't match any client vault stanza; forgetting to add the new cluster's config to client agents after introducing vault.cluster in jobs; typos in the cluster name.","solutions":["Add or fix the vault block for that cluster name in the client agent's config and restart the agent","Correct the task's vault cluster name to match an existing client vault config","Verify the client config includes the cluster before submitting jobs","If Vault is unused, remove the vault block from the task"],"exampleFix":"// before (job)\nvault { cluster = \"prod-vault-2\" }\n// after (client only has the default cluster configured)\nvault { cluster = \"default\" }","handlingStrategy":"validation","validationCode":"# verify the client has the vault cluster before submitting the job\ngrep -A3 'vault' /etc/nomad.d/client.hcl\n# confirm the job's vault cluster name matches a client stanza:\n# vault { cluster \"prod-vault\" { ... } }","typeGuard":null,"tryCatchPattern":"vaultConfig := clientConfig.GetVaultConfigs(logger)[task.GetVaultClusterName()]\nif task.Vault != nil && vaultConfig == nil {\n    return fmt.Errorf(\"vault cluster %q missing from client config; add vault.cluster stanza or fix the job\", vaultCluster)\n}","preventionTips":["Mirror client vault cluster names in a shared naming convention with job specs","Run nomad job validate against the target client configuration","When adding a new vault cluster, update all client agents before jobs reference it","Avoid 'default' vs named cluster mismatches by standardizing the stanza"],"tags":["vault","nomad-client","configuration"],"backgroundTag":"vault-cluster-not-configured","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}