{"record":{"id":"50837ea333a8df52","repo":"hashicorp/nomad","slug":"only-one-server-keyring-can-be-active-in-nomad-com","errorCode":null,"errorMessage":"only one server.keyring can be active in Nomad Community Edition","messagePattern":"only one server\\.keyring can be active in Nomad Community Edition","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter_ce.go","lineNumber":29,"sourceCode":"\t\"github.com/hashicorp/nomad/nomad/structs\"\n)\n\nfunc getProviderConfigs(srv *Server) (map[string]*structs.KEKProviderConfig, error) {\n\tproviderConfigs := map[string]*structs.KEKProviderConfig{}\n\tconfig := srv.GetConfig()\n\tvar active int\n\tfor _, provider := range config.KEKProviderConfigs {\n\t\tif provider.Active {\n\t\t\tactive++\n\t\t}\n\t\tif provider.Provider == structs.KEKProviderVaultTransit {\n\t\t\tfallbackVaultConfig(provider, config.GetDefaultVault())\n\t\t}\n\n\t\tproviderConfigs[provider.ID()] = provider\n\t}\n\tif active > 1 {\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"only one server.keyring can be active in Nomad Community Edition\")\n\t}\n\n\tif len(srv.config.KEKProviderConfigs) == 0 {\n\t\tproviderConfigs[string(structs.KEKProviderAEAD)] = &structs.KEKProviderConfig{\n\t\t\tProvider: structs.KEKProviderAEAD,\n\t\t\tActive:   true,\n\t\t}\n\t}\n\n\treturn providerConfigs, nil\n}\n","sourceCodeStart":11,"sourceCodeEnd":42,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter_ce.go#L11-L42","documentation":"Nomad Community Edition permits only one active KEK provider in the server.keyring configuration. During NewEncrypter, getProviderConfigs counts active providers and aborts with this error when more than one is configured. Nomad Enterprise allows multiple; CE enforces the single-provider limit.","triggerScenarios":"The server config defines more than one active keyring/KEK provider block (e.g. both an aead block and a pkcs11/vault block, or two named providers marked active) on a CE binary.","commonSituations":"Copy-pasting an Enterprise example config into CE; upgrading CE while leftover multiple provider blocks remain in the HCL/JSON config; operators enabling a second provider to 'pre-rotate' without realizing the CE restriction.","solutions":["Remove or disable all but one server.keyring provider block in the config.","If multiple providers are required, use Nomad Enterprise.","Set 'active = false' on the extra provider blocks rather than deleting them, to retain their keys.","Restart the agent and confirm NewEncrypter succeeds.","Audit the config with `nomad agent -config ... -verify-only` before deploy to catch this early."],"exampleFix":"// before (CE)\nserver {\n  keyring {\n    provider = \"aead\"  active = true\n  }\n  keyring {\n    provider = \"pkcs11\" active = true  # second active provider\n  }\n}\n// after\nserver {\n  keyring { provider = \"aead\" active = true }\n  keyring { provider = \"pkcs11\" active = false }\n}","handlingStrategy":"validation","validationCode":"providers := cfg.Server.KEKProviderConfigs\nactive := 0\nfor _, p := range providers {\n\tif p.Active { active++ }\n}\nif active > 1 && isCommunityEdition {\n\treturn fmt.Errorf(\"CE allows only one active server.keyring provider\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep exactly one active keyring block in CE configs","Test configs with `nomad agent -verify-only` before deploys","Check edition (CE vs Ent) when copying example configs","Mark retired providers active = false rather than leaving them active"],"tags":["go","nomad","configuration","licensing","keyring"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}