{"record":{"id":"692eee6c8092a09d","repo":"hashicorp/nomad","slug":"client-introduction-max-identity-ttl-must-be-great-692eee","errorCode":null,"errorMessage":"client_introduction.max_identity_ttl must be greater than default_identity_ttl","messagePattern":"client_introduction\\.max_identity_ttl must be greater than default_identity_ttl","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/agent/config.go","lineNumber":1275,"sourceCode":"\t\treturn nil\n\t}\n\n\tif c.Enforcement == \"\" {\n\t\treturn errors.New(\"client_introduction.enforcement must be set\")\n\t}\n\tif !slices.Contains(ClientIntroductionEnforcementValues, c.Enforcement) {\n\t\treturn fmt.Errorf(\"client_introduction.enforcement must be one of %v\",\n\t\t\tClientIntroductionEnforcementValues)\n\t}\n\n\tif c.DefaultIdentityTTL < 1 {\n\t\treturn errors.New(\"client_introduction.default_identity_ttl must be greater one\")\n\t}\n\tif c.MaxIdentityTTL < 1 {\n\t\treturn errors.New(\"client_introduction.max_identity_ttl must be greater one\")\n\t}\n\tif c.MaxIdentityTTL < c.DefaultIdentityTTL {\n\t\treturn errors.New(\"client_introduction.max_identity_ttl must be greater than default_identity_ttl\")\n\t}\n\n\treturn nil\n}\n\n// ServerJoin is used in both clients and servers to bootstrap connections to\n// servers\ntype ServerJoin struct {\n\t// StartJoin is a list of addresses to attempt to join when the\n\t// agent starts. If Serf is unable to communicate with any of these\n\t// addresses, then the agent will error and exit.\n\tStartJoin []string `hcl:\"start_join\"`\n\n\t// RetryJoin is a list of addresses to join with retry enabled, or a single\n\t// value to find multiple servers using go-discover syntax.\n\tRetryJoin []string `hcl:\"retry_join\"`\n\n\t// RetryMaxAttempts specifies the maximum number of times to retry joining a","sourceCodeStart":1257,"sourceCodeEnd":1293,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/agent/config.go#L1257-L1293","documentation":"The final client_introduction consistency check enforces `max_identity_ttl >= default_identity_ttl`. A default lifetime exceeding the advertised maximum would let the agent issue identities that immediately violate its own ceiling, so Validate() rejects the configuration outright.","triggerScenarios":"Config where client_introduction.default_identity_ttl is numerically greater than max_identity_ttl (both individually >= 1), e.g. default 24h with max 1h.","commonSituations":"Raising default_ttl for longer-lived identities without raising max_ttl; editing one of the two values in automation and not the other; misunderstanding which value must dominate.","solutions":["Raise `max_identity_ttl` to at least the value of `default_identity_ttl`.","Or lower `default_identity_ttl` so it is <= `max_identity_ttl`.","Add a config linter/CI check asserting max >= default for all TTL pairs."],"exampleFix":"// before\nclient_introduction {\n  default_identity_ttl = \"24h\"\n  max_identity_ttl     = \"1h\"\n}\n\n// after\nclient_introduction {\n  default_identity_ttl = \"1h\"\n  max_identity_ttl     = \"24h\"\n}","handlingStrategy":"validation","validationCode":"if c := cfg.ClientIntroduction; c != nil && c.MaxIdentityTTL < c.DefaultIdentityTTL {\n    return errors.New(\"client_introduction.max_identity_ttl must be >= default_identity_ttl\")\n}","typeGuard":"func ttlOrderingValid(c *ClientIntroduction) bool {\n    return c != nil && c.MaxIdentityTTL >= c.DefaultIdentityTTL && c.DefaultIdentityTTL >= 1\n}","tryCatchPattern":null,"preventionTips":["When changing one TTL, always review the other for the max >= default invariant.","Add an invariant test or lint for TTL pairs in your config pipeline.","Document that max_identity_ttl is the ceiling for default_identity_ttl."],"tags":["config-validation","ttl","consistency","client-introduction"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}