{"record":{"id":"9319dc8be2b5942d","repo":"hashicorp/nomad","slug":"d-d-signing-request-was-rejected-v","errorCode":null,"errorMessage":"%d/%d signing request was rejected: %v","messagePattern":"(.+?)/(.+?) signing request was rejected: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/widmgr/signer.go","lineNumber":101,"sourceCode":"\t\tQueryOptions: structs.QueryOptions{\n\t\t\tRegion: s.region,\n\n\t\t\t// Unlike other RPCs, this one doesn't care about \"subsequent\n\t\t\t// modifications\" after an index. We only want to ensure the state\n\t\t\t// isn't too stale to know about this alloc, so we instruct the\n\t\t\t// Server to block at least until the Allocation is created.\n\t\t\tMinQueryIndex: minIndex - 1,\n\t\t\tAllowStale:    true,\n\t\t\tAuthToken:     authToken,\n\t\t},\n\t}\n\treply := structs.AllocIdentitiesResponse{}\n\tif err := s.rpc.RPC(\"Alloc.SignIdentities\", &args, &reply); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif n := len(reply.Rejections); n == 1 {\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"%d/%d signing request was rejected: %v\",\n\t\t\tn, len(req), reply.Rejections[0].Reason,\n\t\t)\n\t} else if n > 1 {\n\t\tvar mErr *multierror.Error\n\t\tfor _, r := range reply.Rejections {\n\t\t\tmErr = multierror.Append(\n\t\t\t\tfmt.Errorf(\n\t\t\t\t\t\"%d/%d signing request was rejected: %v\",\n\t\t\t\t\tn, len(req), r.Reason,\n\t\t\t\t))\n\t\t}\n\t\treturn nil, mErr\n\t}\n\n\tif len(reply.SignedIdentities) == 0 {\n\t\treturn nil, fmt.Errorf(\"empty signed identity response\")\n\t}","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/widmgr/signer.go#L83-L119","documentation":"When the server-side Alloc.SignIdentities RPC rejects exactly one of the requested workload identities, SignIdentities returns a single error embedding the rejection index, total count, and the server's rejection reason. One rejection fails the whole batch by design.","triggerScenarios":"The Alloc.SignIdentities RPC succeeded at the transport level but reply.Rejections contains exactly 1 entry — the server refused to sign one identity (e.g. identity not allowed by policy, unknown workload, signing key unavailable).","commonSituations":"Server older/newer than client so an identity type is unsupported; ACL/policy forbids signing for that identity; the allocation changed and no longer matches the requested identity; node upgrade skew (node vs server versions).","solutions":["Inspect the %v rejection reason to see why the server refused the identity.","Verify client/server Nomad versions match (identity signing support and format).","Check the allocation's workload identity configuration against server-side signing policy/ACLs.","Retry after the allocation/identity state converges (e.g. task updated to have valid identities)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"signed, err := signer.SignIdentities(minIndex, reqs)\nif err != nil {\n    var rej *RejectionError // or match on message prefix\n    logger.Error(\"identity signing rejected\", \"err\", err)\n    // surface the embedded reason; check server version and policy before retry\n    return fmt.Errorf(\"signing failed: %w\", err)\n}","preventionTips":["Keep Nomad client and server versions aligned","Verify workload identity configuration in job specs","Monitor server logs for Alloc.SignIdentities rejections"],"tags":["workload-identity","rpc","rejection","nomad"],"backgroundTag":"identity-signing-rejected","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}