{"record":{"id":"7c93b65d0b7eddc8","repo":"hashicorp/nomad","slug":"role-data-could-not-be-deserialized-w","errorCode":null,"errorMessage":"[✘] Role data could not be deserialized: %w","messagePattern":"\\[✘\\] Role data could not be deserialized: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":433,"sourceCode":"    ttl = \"1h\"\n  }\n}`)\n\treturn 0\n}\n\nfunc (s *SetupVaultCommand) roleExists() bool {\n\texistingRoles, _ := s.vLogical.List(fmt.Sprintf(\"/auth/%s/role\", vaultPath))\n\tif existingRoles != nil {\n\t\treturn slices.Contains(existingRoles.Data[\"keys\"].([]any), vaultRole)\n\t}\n\treturn false\n}\n\nfunc (s *SetupVaultCommand) renderRole() (map[string]any, error) {\n\trole := map[string]any{}\n\terr := json.Unmarshal(vaultRoleBody, &role)\n\tif err != nil {\n\t\treturn role, fmt.Errorf(\"[✘] Role data could not be deserialized: %w\", err)\n\t}\n\n\trole[\"bound_audiences\"] = vaultAud\n\n\treturn role, nil\n}\n\nfunc (s *SetupVaultCommand) createRole(role map[string]any) error {\n\tbuf, err := json.Marshal(role)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Role could not be interpolated with args: %w\", err)\n\t}\n\n\tpath := fmt.Sprintf(\"auth/%s/role/%s\", vaultPath, vaultRole)\n\n\t_, err = s.vLogical.WriteBytes(path, buf)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not create Vault role: %w\", err)","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L415-L451","documentation":"In `nomad setup vault`, renderRole unmarshals the embedded vaultRoleBody JSON template into a map to build the Vault JWT auth role. If that compiled-in constant is not valid JSON, the unmarshal error is wrapped here. Like its Consul counterpart, the template ships with the binary, so failures indicate a corrupted or locally modified build.","triggerScenarios":"json.Unmarshal(vaultRoleBody, &role) fails during `nomad setup vault` — the embedded role JSON is malformed, typically after source edits, a bad merge, or building from an incomplete checkout.","commonSituations":"Building Nomad from a fork where command/setup_vault.go's vaultRoleBody was edited with a JSON syntax error; merge conflict resolution leaving partial JSON; corrupted vendored/source tree; tooling that rewrites string constants breaking escaping.","solutions":["Rebuild from a pristine checkout: `git checkout -- command/setup_vault.go && make build`, or reinstall the official release binary.","Verify binary integrity against the official checksum for your Nomad version.","If you customized vaultRoleBody, validate the JSON with `echo '<json>' | jq .` and fix syntax errors (trailing commas, unquoted keys, bad escapes).","Work around by creating the Vault role manually: `vault write auth/nomad/role/nomad-workloads ...` with your own parameters instead of nomad setup."],"exampleFix":"// before (broken embedded constant)\nconst vaultRoleBody = `{\"user_claim\": \"https://nomad-project\", \"policies\": [\"nomad-workloads\"],}`\n// after (remove trailing comma)\nconst vaultRoleBody = `{\"user_claim\": \"https://nomad-project\", \"policies\": [\"nomad-workloads\"]}`","handlingStrategy":"type-guard","validationCode":"// validate the embedded template before use\nif !json.Valid([]byte(vaultRoleBody)) {\n    return fmt.Errorf(\"vaultRoleBody is not valid JSON\")\n}","typeGuard":"func validJSONObject(b []byte) bool {\n    var m map[string]any\n    return json.Unmarshal(b, &m) == nil && m != nil\n}","tryCatchPattern":"role := map[string]any{}\nif err := json.Unmarshal(vaultRoleBody, &role); err != nil {\n    return role, fmt.Errorf(\"[✘] Role data could not be deserialized: %w\", err)\n}","preventionTips":["Don't hand-edit embedded JSON constants without validating with jq or a JSON linter.","Build from a clean checkout; verify official release checksums before deploying the nomad binary.","Add a CI unit test asserting json.Valid(vaultRoleBody).","For custom role settings, prefer overriding fields after unmarshal (as setup does) rather than rewriting the raw constant."],"tags":["vault","json","setup","cli"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}