{"record":{"id":"1634f6d7ac4024dc","repo":"hashicorp/nomad","slug":"vault-q-not-enabled-but-used-in-the-job","errorCode":null,"errorMessage":"Vault %q not enabled but used in the job","messagePattern":"Vault %q not enabled but used in the job","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hook_vault.go","lineNumber":31,"sourceCode":"type jobVaultHook struct {\n\tsrv *Server\n}\n\nfunc (jobVaultHook) Name() string {\n\treturn \"vault\"\n}\n\nfunc (h jobVaultHook) Validate(job *structs.Job) ([]error, error) {\n\tvaultBlocks := job.Vault()\n\tif len(vaultBlocks) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tfor _, tg := range vaultBlocks {\n\t\tfor _, vaultBlock := range tg {\n\t\t\tvconf := h.srv.config.VaultConfigs[vaultBlock.Cluster]\n\t\t\tif !vconf.IsEnabled() {\n\t\t\t\treturn nil, fmt.Errorf(\"Vault %q not enabled but used in the job\",\n\t\t\t\t\tvaultBlock.Cluster)\n\t\t\t}\n\t\t}\n\t}\n\n\t// Check namespaces.\n\tif err := h.validateNamespaces(vaultBlocks); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn nil, h.validateClustersForNamespace(job, vaultBlocks)\n}\n","sourceCodeStart":13,"sourceCodeEnd":44,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hook_vault.go#L13-L44","documentation":"The job validation hook for Vault checks each job's vault block cluster against the server's configured Vault cluster configs. If the referenced cluster's config is missing or its IsEnabled() is false, the job is rejected because it requests Vault integration that the Nomad server has not enabled.","triggerScenarios":"Submitting a job containing a vault {} stanza whose cluster names a Vault cluster that is not configured in the server's vault { cluster ... enabled = true } configuration, or when no Vault config exists for that cluster name (vconf nil/default => not enabled).","commonSituations":"Vault disabled in the Nomad server config (or server not restarted after adding the vault block); jobs from an environment with Vault submitted to a cluster without it; multi-cluster jobs referencing a non-default vault cluster name that only exists elsewhere; Vault token/allow_unauthenticated misconfig making the cluster effectively disabled.","solutions":["Enable Vault in the Nomad server configuration (vault { enabled = true ... }) and restart the servers.","Remove the vault {} stanza from the job if Vault integration is not needed.","Set the vault block's cluster field to a configured cluster name that is enabled (e.g. the default cluster)."],"exampleFix":"// before\n# nomad server config has no vault block\njob \"web\" {\n  group \"g\" {\n    task \"t\" {\n      vault { cluster = \"prod\" }\n    }\n  }\n}\n// after\n# nomad server config:\n# vault { enabled = true address = \"https://vault:8200\" }\njob \"web\" {\n  group \"g\" {\n    task \"t\" {\n      vault { cluster = \"default\" }\n    }\n  }\n}","handlingStrategy":"validation","validationCode":"// before submit: verify vault is enabled on the target cluster\nconfs, _, err := client.Operator().Vault().ListConfigurations(nil)\nif err != nil { return err }\nenabled := false\nfor _, c := range confs {\n  if c.Enabled != nil && *c.Enabled { enabled = true }\n}\nif !enabled && jobUsesVault(job) {\n  return errors.New(\"job uses vault but no Vault cluster is enabled on this Nomad server\")\n}","typeGuard":"func jobUsesVault(j *api.Job) bool {\n\tfor _, tg := range j.TaskGroups {\n\t\tfor _, t := range tg.Tasks {\n\t\t\tif t.Vault != nil {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"// golang\n_, _, err := client.Jobs().Validate(job, nil)\nif err != nil && strings.Contains(err.Error(), \"not enabled but used in the job\") {\n\t// strip vault blocks or enable Vault on the server before resubmitting\n}","preventionTips":["Verify `vault status` / Nomad agent config shows vault { enabled = true } before deploying Vault-dependent jobs.","Keep vault cluster names consistent across environments or omit the cluster field to use the default.","Gate Vault-dependent deployments on a capability check against the Nomad API.","Restart Nomad servers after changing vault configuration so the new config takes effect."],"tags":["nomad","vault","job-validation","server-config"],"backgroundTag":"vault-not-enabled","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}