{"record":{"id":"6c47666271a6bf66","repo":"hashicorp/nomad","slug":"consul-tokens-for-cluster-s-and-identity-s-reque","errorCode":null,"errorMessage":"consul tokens for cluster %s and identity %s requested by task %s not found","messagePattern":"consul tokens for cluster (.+?) and identity (.+?) requested by task (.+?) not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/template_hook.go","lineNumber":166,"sourceCode":"\t// will try to pick it up from the environment; we want to enforce that we\n\t// don't have a Consul token unless intentionally configured\n\th.consulToken = \"invalid-token\"\n\n\tif hasConsulIdentity {\n\t\tconsulCluster := req.Task.GetConsulClusterName(tg)\n\t\tconsulTokens := h.config.hookResources.GetConsulTokens()\n\t\tclusterTokens := consulTokens[consulCluster]\n\n\t\tif clusterTokens == nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"consul tokens for cluster %s requested by task %s not found\",\n\t\t\t\tconsulCluster, req.Task.Name,\n\t\t\t)\n\t\t}\n\n\t\tconsulToken := clusterTokens[consulWIDName+\"/\"+req.Task.Name]\n\t\tif consulToken == nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"consul tokens for cluster %s and identity %s requested by task %s not found\",\n\t\t\t\tconsulCluster, consulWIDName, req.Task.Name,\n\t\t\t)\n\t\t}\n\n\t\th.consulToken = consulToken.SecretID\n\t} else if h.config.clientConfig.TemplateConfig != nil &&\n\t\th.config.clientConfig.TemplateConfig.UseClientConsulToken {\n\t\tconsulCluster := req.Task.GetConsulClusterName(tg)\n\t\tif config, ok := h.config.clientConfig.ConsulConfigs[consulCluster]; ok {\n\t\t\th.consulToken = config.Token\n\t\t} else {\n\t\t\th.consulToken = \"\"\n\t\t}\n\t}\n\n\t// Set vault namespace if specified\n\tif req.Task.Vault != nil {","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/template_hook.go#L148-L184","documentation":"A variant of the cluster-level token lookup failure: tokens for the Consul cluster exist, but not for the specific workload identity name (consulWIDName) requested by this task. The per-identity key lookup clusterTokens[consulWIDName+\"/\"+req.Task.Name] returned nil.","triggerScenarios":"GetConsulTokens returned a non-nil map for the cluster, but no token was derived under the key '<identity-name>/<task-name>' — e.g. the task's identity name doesn't match the identity the server derived tokens for, or only some identities were populated.","commonSituations":"Renaming a task or its identity block without re-deriving tokens; multiple consul identities where only one is configured server-side; partial failures during token derivation.","solutions":["Confirm the task's consul identity name matches the identity configured in the server's Consul config entries","Check server logs for consul token derivation errors for this specific identity","Redeploy the job so hook resources are rebuilt with all identities","Verify the Consul cluster name and identity name spellings in the job spec"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// confirm the per-identity token exists before use\nclusterTokens := consulTokens[consulCluster]\ntok, ok := clusterTokens[consulWIDName+\"/\"+task.Name]\nif !ok || tok == nil {\n    return fmt.Errorf(\"identity %q not derived for cluster %q\", consulWIDName, consulCluster)\n}","typeGuard":null,"tryCatchPattern":"consulToken := clusterTokens[consulWIDName+\"/\"+req.Task.Name]\nif consulToken == nil {\n    return fmt.Errorf(\"identity %q for cluster %q not derived — check server-side identity config for task %q\", consulWIDName, consulCluster, req.Task.Name)\n}","preventionTips":["Never rename a task or its identity block without a fresh deployment","Ensure every consul identity used by tasks exists in the server's Consul configuration","Use templated policies/names consistently across clusters","Test with a single identity before scaling to multi-identity setups"],"tags":["consul","workload-identity","tokens","nomad-client"],"backgroundTag":"consul-token-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}