{"record":{"id":"7aeedb5f487796e0","repo":"hashicorp/nomad","slug":"default-identity-ttl-must-be-greater-than-0","errorCode":null,"errorMessage":"default_identity_ttl must be greater than 0","messagePattern":"default_identity_ttl must be greater than 0","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/node.go","lineNumber":935,"sourceCode":"// Validate checks that the node introduction configuration is valid.\nfunc (n *NodeIntroductionConfig) Validate() error {\n\n\tif n == nil {\n\t\treturn fmt.Errorf(\"cannot be empty\")\n\t}\n\n\tvar mErr *multierror.Error\n\n\tswitch n.Enforcement {\n\tcase NodeIntroductionEnforcementNone,\n\t\tNodeIntroductionEnforcementWarn,\n\t\tNodeIntroductionEnforcementStrict:\n\tdefault:\n\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"invalid enforcement %q\", n.Enforcement))\n\t}\n\n\tif n.DefaultIdentityTTL < 1 {\n\t\tmErr = multierror.Append(mErr, errors.New(\"default_identity_ttl must be greater than 0\"))\n\t}\n\n\tif n.MaxIdentityTTL < 1 {\n\t\tmErr = multierror.Append(mErr, errors.New(\"max_identity_ttl must be greater than 0\"))\n\t}\n\n\tif n.MaxIdentityTTL < n.DefaultIdentityTTL {\n\t\tmErr = multierror.Append(mErr, errors.New(\n\t\t\t\"max_identity_ttl must be greater than or equal to default_identity_ttl\",\n\t\t))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// NodeIntroductionIdentityClaims contains the claims for node introduction.\ntype NodeIntroductionIdentityClaims struct {\n\tNodePool string `json:\"nomad_node_pool\"`","sourceCodeStart":917,"sourceCodeEnd":953,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/node.go#L917-L953","documentation":"During node/agent config validation, an Enforcement/identity config check appends this error to a multierror when DefaultIdentityTTL is less than 1 (i.e. zero or negative). Workload identity tokens need a positive default TTL; the aggregate error is surfaced by Start/monitor (e.g. api/locks.go LockLeaser wraps returned errors in mErr).","triggerScenarios":"Setting `default_identity_ttl` to 0 or a negative duration in agent/node configuration (or the corresponding struct field) and then starting the agent or a component that validates the config, causing Start to return the aggregated multierror.","commonSituations":"Config stanzas where the TTL was left unset (Go zero value 0) because the operator assumed a built-in default; parsing mistakes that yield 0 (e.g. wrong duration unit or empty string coerced to 0); version upgrades introducing the identity-TTL options with stale config files.","solutions":["Set default_identity_ttl to a positive duration in the agent config (e.g. default_identity_ttl = \"1h\").","Check the surrounding multierror output for related errors (max_identity_ttl) and fix all TTL fields at once.","If the value comes from generated config, fix the template/default so an unset value resolves to a valid duration rather than 0."],"exampleFix":"# before\nnode {\n  max_identity_ttl = \"12h\"\n}\n# after\nnode {\n  default_identity_ttl = \"1h\"\n  max_identity_ttl = \"12h\"\n}","handlingStrategy":"validation","validationCode":"if cfg.DefaultIdentityTTL < 1 {\n\treturn fmt.Errorf(\"default_identity_ttl must be set to a positive duration, got %d\", cfg.DefaultIdentityTTL)\n}","typeGuard":null,"tryCatchPattern":"if err := ll.Start(ctx, fns...); err != nil {\n\tif strings.Contains(err.Error(), \"default_identity_ttl must be greater than 0\") {\n\t\treturn fmt.Errorf(\"fix identity TTL config: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Always set both default and max identity TTLs explicitly in config templates.","Sanity-check parsed durations for zero values after config load.","On upgrades, diff config against the new required options list."],"tags":["nomad","config","validation","ttl"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}