{"record":{"id":"394337b7e4842d3d","repo":"hashicorp/nomad","slug":"task-s-cannot-have-an-identity-for-vault-until-al","errorCode":null,"errorMessage":"Task %s cannot have an identity for Vault until all servers are upgraded to %s or later","messagePattern":"Task (.+?) cannot have an identity for Vault until all servers are upgraded to (.+?) or later","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hooks.go","lineNumber":599,"sourceCode":"// inject task identities if necessary.\nfunc (v *jobValidate) validateVaultIdentity(t *structs.Task, okForIdentity bool) ([]error, error) {\n\tvar warnings []error\n\n\tif t.Vault == nil {\n\t\t// Warn if task doesn't use Vault but has Vault identities.\n\t\tfor _, wid := range t.Identities {\n\t\t\tif strings.HasPrefix(wid.Name, structs.WorkloadIdentityVaultPrefix) {\n\t\t\t\twarnings = append(warnings, fmt.Errorf(\"Task %s has an identity called %s but no vault block\", t.Name, wid.Name))\n\t\t\t}\n\t\t}\n\t\treturn warnings, nil\n\t}\n\n\tvaultWIDName := t.Vault.IdentityName()\n\tvaultWID := t.GetIdentity(vaultWIDName)\n\n\tif vaultWID != nil && !okForIdentity {\n\t\treturn warnings, fmt.Errorf(\"Task %s cannot have an identity for Vault until all servers are upgraded to %s or later\", t.Name, minVersionMultiIdentities)\n\t}\n\n\tif vaultWID == nil {\n\t\t// Tasks using non-default clusters are required to have an identity.\n\t\tif t.Vault.Cluster != structs.VaultDefaultCluster {\n\t\t\treturn warnings, fmt.Errorf(\n\t\t\t\t\"Task %s uses Vault cluster %s but does not have an identity named %s and no default identity is provided in agent configuration\",\n\t\t\t\tt.Name, t.Vault.Cluster, vaultWIDName,\n\t\t\t)\n\t\t}\n\n\t\treturn warnings, nil\n\t}\n\n\treturn warnings, nil\n}\n\ntype memoryOversubscriptionValidate struct {","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hooks.go#L581-L617","documentation":"During job validation, Nomad checks whether a task defines a Workload Identity for Vault. If the task has a Vault identity but the cluster is not yet guaranteed to run servers at minVersionMultiIdentities (the version introducing multi-identities), registration is rejected because older servers cannot handle the identity. This protects mixed-version clusters from jobs that depend on features older servers cannot serve.","triggerScenarios":"Registering or updating a job whose task sets an identity whose name matches t.Vault.IdentityName() (i.e. a Vault workload identity) while the server cluster is not okForIdentity (servers below minVersionMultiIdentities). Raised from validateVaultIdentity via jobendpoint Validate.","commonSituations":"Operator upgrades Nomad partially; a user writes jobs using the new Vault identity syntax (native workload identities instead of Vault token policies) before every server is upgraded; automation templating new job specs onto an older cluster.","solutions":["Upgrade all server agents to minVersionMultiIdentities or later before deploying jobs with Vault identities","Remove the Vault identity from the task (or downgrade the job spec to use Vault policy blocks) until the upgrade completes","Set the identity only on tasks in clusters verified to be at the required version"],"exampleFix":"// before\ntask { identities: [{ name: \"vault_default\", ... }] }\n// after\n// upgrade all servers >= minVersionMultiIdentities, or remove the identity until then\n task { vault { policies: [\"read\"] } }","handlingStrategy":"validation","validationCode":"// before submit\nif task.Identities != nil {\n  for _, id := range task.Identities {\n    if strings.HasPrefix(id.Name, \"vault_\") {\n      ver := serverVersion() // query /v1/agent/health or members\n      if compareSemver(ver, minVersionMultiIdentities) < 0 {\n        return fmt.Errorf(\"server %s too old for vault identities\", ver)\n      }\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Track server versions via nomad server members and block deploys until minVersion is met","Gate new job-spec features behind the upgrade milestone in CI","Keep identity usage centralized in a shared template updated only post-upgrade"],"tags":["nomad","vault","workload-identity","version-compatibility","job-validation"],"backgroundTag":"server-version-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}