{"record":{"id":"3c85712b7a17c8c2","repo":"hashicorp/nomad","slug":"max-identity-ttl-must-be-greater-than-or-equal-to","errorCode":null,"errorMessage":"max_identity_ttl must be greater than or equal to default_identity_ttl","messagePattern":"max_identity_ttl must be greater than or equal to default_identity_ttl","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/node.go","lineNumber":943,"sourceCode":"\n\tswitch n.Enforcement {\n\tcase NodeIntroductionEnforcementNone,\n\t\tNodeIntroductionEnforcementWarn,\n\t\tNodeIntroductionEnforcementStrict:\n\tdefault:\n\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid enforcement %q\", n.Enforcement))\n\t}\n\n\tif n.DefaultIdentityTTL < 1 {\n\t\tmErr = multierror.Append(mErr, errors.New(\"default_identity_ttl must be greater than 0\"))\n\t}\n\n\tif n.MaxIdentityTTL < 1 {\n\t\tmErr = multierror.Append(mErr, errors.New(\"max_identity_ttl must be greater than 0\"))\n\t}\n\n\tif n.MaxIdentityTTL < n.DefaultIdentityTTL {\n\t\tmErr = multierror.Append(mErr, errors.New(\n\t\t\t\"max_identity_ttl must be greater than or equal to default_identity_ttl\",\n\t\t))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// NodeIntroductionIdentityClaims contains the claims for node introduction.\ntype NodeIntroductionIdentityClaims struct {\n\tNodePool string `json:\"nomad_node_pool\"`\n\tNodeName string `json:\"nomad_node_name\"`\n}\n\n// GenerateNodeIntroductionIdentityClaims generates a new identity JWT for node\n// introduction.\n//\n// The caller is responsible for ensuring that the passed arguments are valid.\nfunc GenerateNodeIntroductionIdentityClaims(name, pool, region string, ttl time.Duration) *IdentityClaims {","sourceCodeStart":925,"sourceCodeEnd":961,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/node.go#L925-L961","documentation":"Config validation appends this error to a multierror when MaxIdentityTTL is strictly less than DefaultIdentityTTL. The maximum TTL is an upper bound for issued identity tokens, so it must be greater than or equal to the default TTL; otherwise every token would violate its own ceiling.","triggerScenarios":"Configuring max_identity_ttl to a smaller duration than default_identity_ttl (e.g. default \"12h\" with max \"1h\") and starting the agent, yielding the aggregated multierror with this message.","commonSituations":"Operators tuning the max downward after already raising the default, forgetting the ordering constraint; configs merged from two sources where one raised default_identity_ttl; typo'd duration units (e.g. max \"1h\" vs default \"12h\" intended as \"1d\").","solutions":["Raise max_identity_ttl so it is >= default_identity_ttl (e.g. default \"1h\", max \"12h\").","Alternatively lower default_identity_ttl to fit under the configured maximum.","Read the full multierror list — this often appears together with the two 'must be greater than 0' TTL errors — and fix all three constraints in one edit."],"exampleFix":"# before\nnode {\n  default_identity_ttl = \"12h\"\n  max_identity_ttl = \"1h\"\n}\n# after\nnode {\n  default_identity_ttl = \"1h\"\n  max_identity_ttl = \"12h\"\n}","handlingStrategy":"validation","validationCode":"if cfg.MaxIdentityTTL < cfg.DefaultIdentityTTL {\n\treturn fmt.Errorf(\"max_identity_ttl (%d) must be >= default_identity_ttl (%d)\", cfg.MaxIdentityTTL, cfg.DefaultIdentityTTL)\n}","typeGuard":null,"tryCatchPattern":"if err := ll.Start(ctx, fns...); err != nil {\n\tif strings.Contains(err.Error(), \"max_identity_ttl must be greater than or equal to default_identity_ttl\") {\n\t\treturn fmt.Errorf(\"reorder identity TTL bounds: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Apply a single source of truth for TTL bounds so max is always >= default.","After any config merge, assert the max >= default invariant.","Use unambiguous duration units to avoid accidental inversions."],"tags":["nomad","config","validation","ttl"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}