{"record":{"id":"a7ebe558ecc86f5b","repo":"hashicorp/nomad","slug":"task-s-has-an-identity-called-s-but-no-vault-blo","errorCode":null,"errorMessage":"Task %s has an identity called %s but no vault block","messagePattern":"Task (.+?) has an identity called (.+?) but no vault block","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"nomad/job_endpoint_hooks.go","lineNumber":589,"sourceCode":"\t\treturn fmt.Errorf(\"Service %s in %s has an identity with an empty name\", s.Name, parent)\n\t}\n\n\treturn nil\n}\n\n// validateVaultIdentity validates that a task is properly configured to access\n// a Vault cluster.\n//\n// It assumes the jobImplicitIdentitiesHook mutator hook has been called to\n// inject task identities if necessary.\nfunc (v *jobValidate) validateVaultIdentity(t *structs.Task, okForIdentity bool) ([]error, error) {\n\tvar warnings []error\n\n\tif t.Vault == nil {\n\t\t// Warn if task doesn't use Vault but has Vault identities.\n\t\tfor _, wid := range t.Identities {\n\t\t\tif strings.HasPrefix(wid.Name, structs.WorkloadIdentityVaultPrefix) {\n\t\t\t\twarnings = append(warnings, fmt.Errorf(\"Task %s has an identity called %s but no vault block\", t.Name, wid.Name))\n\t\t\t}\n\t\t}\n\t\treturn warnings, nil\n\t}\n\n\tvaultWIDName := t.Vault.IdentityName()\n\tvaultWID := t.GetIdentity(vaultWIDName)\n\n\tif vaultWID != nil && !okForIdentity {\n\t\treturn warnings, fmt.Errorf(\"Task %s cannot have an identity for Vault until all servers are upgraded to %s or later\", t.Name, minVersionMultiIdentities)\n\t}\n\n\tif vaultWID == nil {\n\t\t// Tasks using non-default clusters are required to have an identity.\n\t\tif t.Vault.Cluster != structs.VaultDefaultCluster {\n\t\t\treturn warnings, fmt.Errorf(\n\t\t\t\t\"Task %s uses Vault cluster %s but does not have an identity named %s and no default identity is provided in agent configuration\",\n\t\t\t\tt.Name, t.Vault.Cluster, vaultWIDName,","sourceCodeStart":571,"sourceCodeEnd":607,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hooks.go#L571-L607","documentation":"Tasks not using Vault (no vault block) should not carry Vault workload identities. This is a warning (not an error) emitted when a task has an identity whose name starts with the Vault WID prefix (vault_) but no vault stanza, suggesting leftover config.","triggerScenarios":"Validating a job where t.Vault is nil but one of the task's identities has a name prefixed with structs.WorkloadIdentityVaultPrefix (\"vault_\").","commonSituations":"Removing the vault block but forgetting to drop the matching identity; copy-pasting identity blocks from other tasks; renames leaving stale vault_ identities.","solutions":["Delete the unused vault_-prefixed identity from the task's identities list","Re-add the vault block if Vault access is actually intended","Rename the identity if it is non-Vault but accidentally named with the vault_ prefix"],"exampleFix":"// before\ntask \"app\" { identities = [{ name = \"vault_default\" }] }  # no vault block\n// after\ntask \"app\" { identities = [] }  # or restore vault {} block","handlingStrategy":"validation","validationCode":"if task.Vault == nil {\n\tfor _, id := range task.Identities {\n\t\tif strings.HasPrefix(id.Name, \"vault_\") {\n\t\t\tfmt.Printf(\"warning: task %s has vault identity %s without vault block\\n\", task.Name, id.Name)\n\t\t}\n\t}\n}","typeGuard":"func hasOrphanVaultIdentity(t *api.Task) bool {\n\treturn t.Vault == nil && slices.ContainsFunc(t.Identities,\n\t\tfunc(w *api.WorkloadIdentity) bool { return strings.HasPrefix(w.Name, \"vault_\") })\n}","tryCatchPattern":null,"preventionTips":["Remove vault_ identities together with the vault block in one change","Keep a single naming convention for identities to spot orphans","Treat this warning as blocking in CI since it usually signals leftover config"],"tags":["nomad","workload-identity","vault","job-spec"],"backgroundTag":"orphan-workload-identity","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}