{"record":{"id":"48c1c1e7921735dc","repo":"hashicorp/nomad","slug":"auth-method-could-not-be-interpolated-with-args","errorCode":null,"errorMessage":"auth method could not be interpolated with args: %w","messagePattern":"auth method could not be interpolated with args: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":529,"sourceCode":"\t\tcaCert, err := os.ReadFile(s.jwksCACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not read -jwks-certfile: %v\", err)\n\t\t}\n\t\tauthConfig[\"jwks_ca_pem\"] = string(caCert)\n\t}\n\n\treturn authConfig, nil\n}\n\nfunc (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {\n\terr := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: \"jwt\"})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not enable JWT credential backend: %w\", err)\n\t}\n\n\tbuf, err := json.Marshal(authConfig)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"auth method could not be interpolated with args: %w\", err)\n\t}\n\t_, err = s.vLogical.WriteBytes(fmt.Sprintf(\"auth/%s/config\", vaultPath), buf)\n\tif err != nil {\n\t\tif strings.Contains(err.Error(), \"error checking jwks URL\") {\n\t\t\ts.Ui.Error(fmt.Sprintf(\n\t\t\t\t\"error: Nomad JWKS endpoint unreachable, verify that Nomad is running and that the JWKS URL %s is reachable by Vault\", s.jwksURL,\n\t\t\t))\n\t\t\tos.Exit(1)\n\t\t}\n\t\treturn fmt.Errorf(\"[✘] Could not create Vault auth method: %w\", err)\n\t}\n\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created JWT auth method %q.\", vaultPath))\n\treturn nil\n}\n\n// namespaceExists takes checks if ns exists. if destroy is true, it will check\n// for custom metadata presence to prevent deleting a namespace we didn't","sourceCodeStart":511,"sourceCodeEnd":547,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L511-L547","documentation":"After enabling the JWT backend, createAuthMethod marshals the auth config map and writes it to auth/<path>/config. This error wraps a json.Marshal failure of the config map (unsupported value types), analogous to the role interpolation error.","triggerScenarios":"json.Marshal(authConfig) fails because renderAuthMethod or custom code put a non-serializable value into the config map.","commonSituations":"Patched binaries injecting unsupported types into the config map; normally unreachable via CLI flags which produce strings.","solutions":["Ensure authConfig values are strings/bools/maps only","Rebuild from clean source without local modifications","Log the config map types before marshaling when debugging"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for k, v := range authConfig {\n    switch v.(type) {\n    case string, bool, float64, map[string]any, []any:\n    default:\n        return fmt.Errorf(\"auth config key %q has unsupported type %T\", k, v)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep auth config values to JSON-primitive types","Unit test marshaling of the rendered auth config","Avoid patched builds that inject custom values"],"tags":["go","json","vault","serialization"],"backgroundTag":"json-marshal-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}