{"record":{"id":"916c2fb108a03357","repo":"hashicorp/nomad","slug":"allocation-does-not-exist","errorCode":null,"errorMessage":"allocation does not exist","messagePattern":"allocation does not exist","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/auth/auth.go","lineNumber":729,"sourceCode":"\t}\n\tif registration == nil {\n\t\treturn \"\", structs.ErrPermissionDenied\n\t}\n\n\treturn resolveAuthorizedClientNodePoolByNodeID(snap, aclObj, registration.NodeID)\n}\n\nfunc (s *Authenticator) verifyWorkloadIdentityClaim(claims *structs.IdentityClaims) error {\n\tsnap, err := s.getState().Snapshot()\n\tif err != nil {\n\t\treturn err\n\t}\n\talloc, err := snap.AllocByID(nil, claims.AllocationID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif alloc == nil || alloc.Job == nil {\n\t\treturn fmt.Errorf(\"allocation does not exist\")\n\t}\n\n\t// the claims for terminal allocs are always treated as expired\n\tif alloc.ClientTerminalStatus() {\n\t\treturn fmt.Errorf(\"allocation is terminal\")\n\t}\n\n\treturn nil\n}\n\nfunc (s *Authenticator) resolveClaims(claims *structs.IdentityClaims) (*acl.ACL, error) {\n\n\t// Nomad node identity claims currently map to a client ACL. If we open this\n\t// up in the future, we will want to modify this section to perform similar\n\t// work that is done for workload claims.\n\tif claims.IsNode() {\n\t\tif claims.NodeIdentityClaims == nil || claims.NodeIdentityClaims.NodePool == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"node identity claims missing node pool\")","sourceCodeStart":711,"sourceCodeEnd":747,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/auth/auth.go#L711-L747","documentation":"verifyWorkloadIdentityClaim validates a signed workload identity JWT against the current state snapshot. After verifying the claims' allocation ID exists (and has a job), it rejects the claim with 'allocation does not exist' when the alloc is nil or its Job reference is missing — meaning the token references an allocation the server no longer knows about.","triggerScenarios":"VerifyClaim is called with a workload identity JWT whose AllocationID does not resolve to a live allocation in the state store, or the alloc exists without an associated job (job purged while alloc row lingers).","commonSituations":"Job deleted/garbage-collected; alloc already reaped from the state store; client presenting an old identity token after the allocation was removed; wrong cluster/region receiving the token.","solutions":["Confirm the allocation ID in the claims still exists: `nomad alloc status <alloc-id>`","Obtain a fresh workload identity token from a live allocation instead of reusing the old one","If the job was deleted but needed, redeploy it so the alloc/job references resolve","Ensure the token is verified against the correct region/cluster where the allocation ran"],"exampleFix":"// before: verifying a stale identity token for a reaped alloc\nclaims.VerifyClaim(oldToken)\n// after: check the alloc first\nalloc, _ := client.Allocations().Info(ctx, allocID)\nif alloc != nil {\n    claims.VerifyClaim(freshToken)\n}","handlingStrategy":"validation","validationCode":"alloc, _, err := client.Allocations().Info(ctx, allocID)\nif err != nil || alloc == nil || alloc.Job == nil {\n    return errors.New(\"allocation gone: obtain a fresh workload identity token\")\n}","typeGuard":"func allocUsableForClaim(a *api.Allocation) bool {\n    return a != nil && a.Job != nil && a.ClientStatus != \"lost\"\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"allocation does not exist\") {\n    // refresh the identity token from a live allocation\n    token, err = requestNewWorkloadIdentityToken()\n}","preventionTips":["Always fetch a fresh workload identity token from a live allocation before verifying","Check `nomad alloc status` after job deletions to confirm allocs are gone","Verify tokens against the region/cluster where the allocation actually ran","Handle terminal/reaped allocs explicitly in token-refresh logic"],"tags":["nomad","workload-identity","jwt","allocation"],"backgroundTag":"jwt-claim-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}