{"record":{"id":"2d08deac67ab9873","repo":"hashicorp/nomad","slug":"missing-accessor-id","errorCode":null,"errorMessage":"missing accessor ID","messagePattern":"missing accessor ID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/acl.go","lineNumber":147,"sourceCode":"// Create is used to create a token with server-generated AccessorID and\n// SecretID. Use Upload to create a token with pre-specified IDs.\nfunc (a *ACLTokens) Create(token *ACLToken, q *WriteOptions) (*ACLToken, *WriteMeta, error) {\n\tif token.AccessorID != \"\" {\n\t\treturn nil, nil, errors.New(\"cannot specify Accessor ID\")\n\t}\n\tvar resp ACLToken\n\twm, err := a.client.put(\"/v1/acl/token\", token, &resp, q)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\treturn &resp, wm, nil\n}\n\n// Upload is used to create a client token with pre-specified AccessorID and\n// SecretID. Management tokens cannot be uploaded and must be created with Create.\nfunc (a *ACLTokens) Upload(token *ACLToken, q *WriteOptions) (*ACLToken, *WriteMeta, error) {\n\tif token.AccessorID == \"\" {\n\t\treturn nil, nil, errors.New(\"missing accessor ID\")\n\t}\n\tif token.SecretID == \"\" {\n\t\treturn nil, nil, errors.New(\"missing secret ID\")\n\t}\n\tif token.Type == \"management\" {\n\t\treturn nil, nil, errors.New(\"cannot upload management tokens\")\n\t}\n\tvar resp ACLToken\n\twm, err := a.client.put(\"/v1/acl/token/\"+token.AccessorID, token, &resp, q)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\treturn &resp, wm, nil\n}\n\n// Update is used to update an existing token\nfunc (a *ACLTokens) Update(token *ACLToken, q *WriteOptions) (*ACLToken, *WriteMeta, error) {\n\tif token.AccessorID == \"\" {","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/api/acl.go#L129-L165","documentation":"The target node is registered in Nomad but has no CSINodePlugins entry (or nil NodeInfo) for the volume's PluginID — the CSI node plugin is not running or has not fingerprinted on that client. lookupExternalNodeID needs the plugin-reported external node ID to talk to the storage controller.","triggerScenarios":"controllerPublishVolume/unpublish while the node plugin task is crashed/pending, the plugin hasn't completed fingerprinting yet, the plugin's NodeIDLabel is unset, or the plugin is registered with a different PluginID than the volume references.","commonSituations":"Client just started and CSI plugin still initializing; plugin job failed due to missing privileges (--privileged, mount propagation) or missing csi.sock; plugin deregistered from node but volume still scheduled there; timing race right after allocation.","solutions":["Check plugin health on the client: nomad node status <id> -verbose and look for the CSI plugin fingerprint","Inspect the plugin alloc logs (nomad alloc logs) for fingerprint/socket errors","Fix plugin task requirements (privileged:true, mount propagation, host volumes) so csi.sock is exposed","Wait/retry — if the plugin merely hasn't fingerprinted yet, the claim runner retries later","Confirm vol.PluginID matches the ID the node plugin registered with"],"exampleFix":"// before: CSI task without required privileges\n task \"ebs-plugin\" {\n   driver = \"docker\"\n   config { image = \"amazon/aws-ebs-csi-driver\" }\n   csi_plugin { id = \"aws-ebs\" type = \"node\" mount_dir = \"/csi\" }\n }\n// after\n task \"ebs-plugin\" {\n   driver = \"docker\"\n   config {\n     image = \"amazon/aws-ebs-csi-driver\"\n     privileged = true\n     mount_types = [\"bind\"]\n   }\n   csi_plugin { id = \"aws-ebs\" type = \"node\" mount_dir = \"/csi\" }\n }","handlingStrategy":"validation","validationCode":"node, _, _ := client.Nodes().Info(nodeID, nil)\ninfo, ok := node.CSINodePlugins[pluginID]\nif !ok || info.NodeInfo == nil {\n    // plugin not fingerprinted on client: wait or fix plugin task\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to find storage provider info\") {\n    // wait for fingerprinting, check plugin alloc logs, retry\n    waitForPluginFingerprint(nodeID, pluginID)\n}","preventionTips":["Run node plugins with required privileges and mount propagation","Gate scheduling on plugin fingerprint health checks","Ensure plugin job ID/ID matches vol.PluginID exactly"],"tags":["nomad","csi","fingerprinting","node-plugin"],"backgroundTag":"csi-plugin-not-fingerprinted","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}