{"record":{"id":"16956e83aa3a81f6","repo":"hashicorp/nomad","slug":"ttl-for-default-identity-not-yet-supported","errorCode":null,"errorMessage":"ttl for default identity not yet supported","messagePattern":"ttl for default identity not yet supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":486,"sourceCode":"\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.\n\t\tif wi.ChangeSignal != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"can only use change_signal=%q with change_mode=%q\",\n\t\t\t\twi.ChangeSignal, WIChangeModeSignal))\n\t\t}\n\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"change_signal must be specified when using change_mode=%q\", WIChangeModeSignal))\n\t\t}\n\tdefault:\n\t\t// Unknown change_mode\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid change_mode: %s\", wi.ChangeMode))\n\t}\n\n\tif wi.TTL > 0 && (wi.Name == \"\" || wi.Name == WorkloadIdentityDefaultName) {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl for default identity not yet supported\"))\n\t}\n\n\tif wi.TTL < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl must be >= 0\"))\n\t}\n\n\tif wi.Filepath != \"\" && !wi.File {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"file parameter must be true in order to specify filepath\"))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\nfunc (wi *WorkloadIdentity) Warnings() error {\n\tif wi == nil {\n\t\treturn fmt.Errorf(\"must not be nil\")\n\t}\n","sourceCodeStart":468,"sourceCodeEnd":504,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L468-L504","documentation":"WorkloadIdentity.Validate rejects a positive TTL on the default identity (name empty or \"default\"). Nomad does not yet support expiring tokens for the default workload identity, so such a configuration is invalid. Only explicitly-named identities may carry a TTL.","triggerScenarios":"Defining an identity block with ttl > 0 while name is unset or equals \"default\", e.g. identity { ttl = \"1h\" } in a task's identity block, or structs.WorkloadIdentity{Name: \"\", TTL: duration} passed to Validate().","commonSituations":"Adding a TTL to the implicit default identity assuming it behaves like named identities; templating a job where the identity name is dropped/blank; copying a named-identity TTL config onto the default identity.","solutions":["Give the identity an explicit non-default name (e.g. name = \"aws\") when setting ttl.","Remove the ttl from the default identity block until Nomad supports TTLs on the default identity.","Use a separate named identity block for the expiring credential instead of the default one."],"exampleFix":"// before\nidentity {\n  ttl = \"1h\"\n}\n// after\nidentity {\n  name = \"aws\"\n  ttl = \"1h\"\n}","handlingStrategy":"validation","validationCode":"func validateTTLIdentity(wi *structs.WorkloadIdentity) error {\n  if wi.TTL > 0 && (wi.Name == \"\" || wi.Name == structs.WorkloadIdentityDefaultName) {\n    return fmt.Errorf(\"ttl requires a named (non-default) identity\")\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only set ttl on identity blocks with an explicit name.","Track Nomad release notes for when default-identity TTLs become supported.","Centralize identity block construction in a helper that enforces the name+TTL rule."],"tags":["nomad","workload-identity","validation","ttl"],"backgroundTag":"unsupported-feature","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}