{"record":{"id":"95568030d1f8906a","repo":"hashicorp/nomad","slug":"invalid-change-mode-s","errorCode":null,"errorMessage":"invalid change_mode: %s","messagePattern":"invalid change_mode: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":482,"sourceCode":"\t\tif aud == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"an empty string is an invalid audience (%d)\", i+1))\n\t\t}\n\t}\n\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.\n\t\tif wi.ChangeSignal != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"can only use change_signal=%q with change_mode=%q\",\n\t\t\t\twi.ChangeSignal, WIChangeModeSignal))\n\t\t}\n\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"change_signal must be specified when using change_mode=%q\", WIChangeModeSignal))\n\t\t}\n\tdefault:\n\t\t// Unknown change_mode\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid change_mode: %s\", wi.ChangeMode))\n\t}\n\n\tif wi.TTL > 0 && (wi.Name == \"\" || wi.Name == WorkloadIdentityDefaultName) {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl for default identity not yet supported\"))\n\t}\n\n\tif wi.TTL < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl must be >= 0\"))\n\t}\n\n\tif wi.Filepath != \"\" && !wi.File {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"file parameter must be true in order to specify filepath\"))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\nfunc (wi *WorkloadIdentity) Warnings() error {","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L464-L500","documentation":"WorkloadIdentity.Validate rejects any ChangeMode value it does not recognize. Only \"restart\", \"signal\" (and empty, meaning default) are accepted. This catches typos or modes from newer/older Nomad versions that the validating binary does not understand.","triggerScenarios":"Setting change_mode in an identity block to a misspelled or unsupported string (e.g. \"signals\", \"rollover\", \"none\") so it matches neither WIChangeModeRestart nor WIChangeModeSignal and falls into the default branch of Validate().","commonSituations":"Typo in job HCL change_mode value; running an older Nomad agent that lacks a newer change_mode introduced later; generating job JSON programmatically with a bad constant.","solutions":["Set change_mode to one of the supported values: \"restart\", \"signal\", or omit it for the default.","Fix any spelling of the change_mode value in the job spec.","If using a newer mode, upgrade the Nomad agent/CLI doing validation to a version that supports it."],"exampleFix":"// before\nidentity {\n  name = \"aws\"\n  change_mode = \"signals\"\n}\n// after\nidentity {\n  name = \"aws\"\n  change_mode = \"signal\"\n  change_signal = \"SIGHUP\"\n}","handlingStrategy":"validation","validationCode":"var validChangeModes = map[string]bool{\"\": true, structs.WIChangeModeRestart: true, structs.WIChangeModeSignal: true}\nfunc validateChangeMode(mode string) error {\n  if !validChangeModes[mode] {\n    return fmt.Errorf(\"change_mode %q not supported\", mode)\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use constants (WIChangeModeRestart/WIChangeModeSignal) instead of string literals in Go code.","Check Nomad version compatibility before using newly introduced change_mode values.","Validate job specs with nomad job validate before submission."],"tags":["nomad","workload-identity","validation","enum-value"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}