{"record":{"id":"acc7c4d3a92bd77a","repo":"hashicorp/nomad","slug":"can-only-use-change-signal-q-with-change-mode-q","errorCode":null,"errorMessage":"can only use change_signal=%q with change_mode=%q","messagePattern":"can only use change_signal=%q with change_mode=%q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":473,"sourceCode":"\n\tvar mErr multierror.Error\n\n\tif !validIdentityName.MatchString(wi.Name) {\n\t\terr := fmt.Errorf(\"invalid name %q. Must match regex %s\", wi.Name, validIdentityName)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\tfor i, aud := range wi.Audience {\n\t\tif aud == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"an empty string is an invalid audience (%d)\", i+1))\n\t\t}\n\t}\n\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.\n\t\tif wi.ChangeSignal != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"can only use change_signal=%q with change_mode=%q\",\n\t\t\t\twi.ChangeSignal, WIChangeModeSignal))\n\t\t}\n\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"change_signal must be specified when using change_mode=%q\", WIChangeModeSignal))\n\t\t}\n\tdefault:\n\t\t// Unknown change_mode\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid change_mode: %s\", wi.ChangeMode))\n\t}\n\n\tif wi.TTL > 0 && (wi.Name == \"\" || wi.Name == WorkloadIdentityDefaultName) {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl for default identity not yet supported\"))\n\t}\n\n\tif wi.TTL < 0 {\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"ttl must be >= 0\"))\n\t}","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L455-L491","documentation":"WorkloadIdentity.Validate returns this error when ChangeSignal is set while ChangeMode is empty, \"noop\", or \"restart\". change_signal only makes sense with change_mode = \"signal\"; otherwise the signal would never be delivered, so Nomad flags the combination as invalid.","triggerScenarios":"Validate() on a WorkloadIdentity where ChangeSignal != \"\" but ChangeMode is \"\", WIChangeModeNoop, or WIChangeModeRestart — e.g. a job spec with change_signal = \"SIGHUP\" but no (or a non-signal) change_mode.","commonSituations":"Copying a signal-handling identity block but changing change_mode to restart; assuming a signal defaults to signal mode; leftover change_signal after removing change_mode = \"signal\".","solutions":["Set change_mode = \"signal\" so the change_signal is actually used.","Or remove the change_signal field if you intend noop/restart behavior.","Validate the full identity locally — the error names both the signal and the required mode."],"exampleFix":"// before\nchange_mode = \"restart\"\nchange_signal = \"SIGHUP\"\n// after\nchange_mode = \"signal\"\nchange_signal = \"SIGHUP\"","handlingStrategy":"validation","validationCode":"if wi.ChangeSignal != \"\" && wi.ChangeMode != \"signal\" {\n    return fmt.Errorf(\"change_signal requires change_mode = signal\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only set change_signal together with change_mode = \"signal\".","Remove change_signal when switching to restart/noop modes.","Lint job templates for orphaned change_signal fields."],"tags":["nomad","workload-identity","validation","config"],"backgroundTag":"incompatible-option-combination","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}