{"record":{"id":"2c5d33a8473306f3","repo":"hashicorp/nomad","slug":"identity-q-is-invalid-w","errorCode":null,"errorMessage":"Identity %q is invalid: %w","messagePattern":"Identity %q is invalid: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":8427,"sourceCode":"\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"CSIPluginConfig must have a non-empty PluginID\"))\n\t\t}\n\n\t\tif !CSIPluginTypeIsValid(t.CSIPluginConfig.Type) {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"CSIPluginConfig PluginType must be one of 'node', 'controller', or 'monolith', got: \\\"%s\\\"\", t.CSIPluginConfig.Type))\n\t\t}\n\n\t\tif t.CSIPluginConfig.StagePublishBaseDir != \"\" && t.CSIPluginConfig.MountDir != \"\" &&\n\t\t\thelper.IsSubdirectory(t.CSIPluginConfig.MountDir, t.CSIPluginConfig.StagePublishBaseDir) {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"CSIPluginConfig StagePublishBaseDir must not be a subdirectory of MountDir, got: StagePublishBaseDir=\\\"%s\\\" MountDir=\\\"%s\\\"\", t.CSIPluginConfig.StagePublishBaseDir, t.CSIPluginConfig.MountDir))\n\t\t}\n\n\t\t// TODO: Investigate validation of the PluginMountDir. Not much we can do apart from check IsAbs until after we understand its execution environment though :(\n\t}\n\n\t// Validate default Identity\n\tif t.Identity != nil {\n\t\tif err := t.Identity.Validate(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Identity %q is invalid: %w\", t.Identity.Name, err))\n\t\t}\n\t}\n\n\t// Validate Identities\n\tfor _, wid := range t.Identities {\n\t\t// Task.Canonicalize should move the default identity out of the Identities\n\t\t// slice, so if one is found that means it is a duplicate.\n\t\tif wid.Name == WorkloadIdentityDefaultName {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Duplicate default identities found\"))\n\t\t}\n\n\t\tif err := wid.Validate(); err != nil {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"Identity %q is invalid: %w\", wid.Name, err))\n\t\t}\n\t}\n\n\tsecrets := make(map[string]bool)\n\tfor _, s := range t.Secrets {","sourceCodeStart":8409,"sourceCodeEnd":8445,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L8409-L8445","documentation":"When a task declares a default identity block, Task.Validate calls WorkloadIdentity.Validate and wraps any failure as 'Identity %q is invalid: %w'. The inner error comes from the identity's own validation (missing name is impossible for the default, so usually audience/expiration/TTL problems).","triggerScenarios":"identity { } block in a task whose Validate fails, e.g. identity with an invalid ttl, negative expiration, or file/cloud-platform settings that don't parse; the wrapped error names the identity and the underlying reason.","commonSituations":"Misconfigured workload identity TTLs (ttl = \"five minutes\" instead of \"5m\"); env claiming identity blocks combined with file ones incorrectly; version drift where a new identity option isn't supported by the cluster.","solutions":["Read the wrapped %w error after 'is invalid:' for the exact field problem","Fix the identity block per error, e.g. use a valid Go duration for ttl (\"1h\", \"30m\")","Run `nomad job validate job.hcl` locally to iterate on identity validation before submitting"],"exampleFix":"// before\nidentity {\n  env = true\n  ttl = \"five minutes\"\n}\n// after\nidentity {\n  env = true\n  ttl = \"5m\"\n}","handlingStrategy":"validation","validationCode":"if t.Identity != nil {\n    if err := t.Identity.Validate(); err != nil {\n        return fmt.Errorf(\"default identity bad: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := job.Validate(); err != nil {\n    var mErr *structs.MultiError\n    if errors.As(err, &mErr) { /* inspect wrapped identity errors */ }\n}","preventionTips":["Use valid Go duration strings for ttl (e.g. \"5m\", \"1h\")","Keep identity options (env/file/aud) consistent with cluster Nomad version","Run `nomad job validate` before submit to surface identity errors early"],"tags":["nomad","workload-identity","validation"],"backgroundTag":"identity-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}