{"record":{"id":"1925f3d99bc73348","repo":"hashicorp/nomad","slug":"non-default-vault-cluster-requires-nomad-enterpris","errorCode":null,"errorMessage":"non-default Vault cluster requires Nomad Enterprise","messagePattern":"non-default Vault cluster requires Nomad Enterprise","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hook_vault_ce.go","lineNumber":30,"sourceCode":"\n\t\"github.com/hashicorp/nomad/nomad/structs\"\n)\n\n// validateNamespaces returns an error if the job contains any Vault namespaces.\nfunc (jobVaultHook) validateNamespaces(blocks map[string]map[string]*structs.Vault) error {\n\n\trequestedNamespaces := structs.VaultNamespaceSet(blocks)\n\tif len(requestedNamespaces) > 0 {\n\t\treturn fmt.Errorf(\"%w, Namespaces: %s\", ErrMultipleNamespaces, strings.Join(requestedNamespaces, \", \"))\n\t}\n\treturn nil\n}\n\nfunc (h jobVaultHook) validateClustersForNamespace(_ *structs.Job, blocks map[string]map[string]*structs.Vault) error {\n\tfor _, tg := range blocks {\n\t\tfor _, vault := range tg {\n\t\t\tif vault.Cluster != \"default\" {\n\t\t\t\treturn errors.New(\"non-default Vault cluster requires Nomad Enterprise\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (h jobVaultHook) Mutate(job *structs.Job) (*structs.Job, []error, error) {\n\tfor _, tg := range job.TaskGroups {\n\t\tfor _, task := range tg.Tasks {\n\t\t\tif task.Vault == nil || task.Vault.Cluster != \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\ttask.Vault.Cluster = \"default\"\n\t\t}\n\t}\n\n\treturn job, nil, nil","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hook_vault_ce.go#L12-L48","documentation":"CE build guard in jobVaultHook.validateClustersForNamespace: a job references a Vault cluster other than the default (multi-cluster/namespace Vault integration), which is Nomad Enterprise-only, so validation fails on the open-source edition.","triggerScenarios":"Setting `vault { cluster = \"<name>\" }` in a task/group/job on a Nomad OSS server and validating the job.","commonSituations":"Copying Enterprise multi-Vault-cluster job files to OSS; attempting to target a second Vault cluster without a license.","solutions":["Remove the `cluster` field (or set it to \"default\") in the job's vault block.","Upgrade to Nomad Enterprise for multi-Vault-cluster support.","Configure the agent's single Vault cluster appropriately instead."],"exampleFix":"// before\nvault {\n  cluster = \"prod-vault\"\n  policies = [\"app\"]\n}\n\n// after\nvault {\n  policies = [\"app\"]\n}","handlingStrategy":"validation","validationCode":"if job.Vault != nil && job.Vault.Cluster != \"\" && job.Vault.Cluster != \"default\" {\n  return errors.New(\"non-default Vault cluster requires Nomad Enterprise\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Leave vault.cluster unset on OSS","Verify Vault cluster naming config against the server edition","Lint job files for enterprise-only fields before deploy"],"tags":["nomad","vault","enterprise-only","job-validation"],"backgroundTag":"nomad-enterprise-feature-required","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}