{"record":{"id":"b8fc3f925b375066","repo":"hashicorp/nomad","slug":"failed-to-sign-node-identity-claims-v","errorCode":null,"errorMessage":"failed to sign node identity claims: %v","messagePattern":"failed to sign node identity claims: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/node_endpoint.go","lineNumber":253,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to query node pool: %v\", err)\n\t\t}\n\t\tif nodePool == nil {\n\t\t\tidentityTTL = structs.DefaultNodePoolNodeIdentityTTL\n\t\t} else {\n\t\t\tidentityTTL = nodePool.NodeIdentityTTL\n\t\t}\n\n\t\t// Check if we need to generate a node identity. This must happen before we\n\t\t// send the Raft message, as the signing key ID is set on the node if we\n\t\t// generate one.\n\t\tif args.ShouldGenerateNodeIdentity(authErr, timeNow.UTC(), identityTTL) {\n\n\t\t\tclaims := structs.GenerateNodeIdentityClaims(args.Node, n.srv.Region(), identityTTL)\n\n\t\t\tsignedJWT, signingKeyID, err := n.srv.encrypter.SignClaims(claims)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to sign node identity claims: %v\", err)\n\t\t\t}\n\n\t\t\treply.SignedIdentity = &signedJWT\n\t\t\targs.Node.IdentitySigningKeyID = signingKeyID\n\t\t} else if originalNode != nil {\n\t\t\targs.Node.IdentitySigningKeyID = originalNode.IdentitySigningKeyID\n\t\t}\n\t}\n\n\t_, index, err := n.srv.raftApply(structs.NodeRegisterRequestType, args)\n\tif err != nil {\n\t\tn.logger.Error(\"register failed\", \"error\", err)\n\t\treturn err\n\t}\n\treply.NodeModifyIndex = index\n\n\t// Check if we should trigger evaluations\n\tif shouldCreateNodeEval(originalNode, args.Node) {","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/node_endpoint.go#L235-L271","documentation":"When a registering node should receive fresh identity JWT claims, the server signs them via SignClaims. If signing fails (e.g., no keyring/key available), Register returns 'failed to sign node identity claims'. This is a server-side signing/keyring failure.","triggerScenarios":"Node.Register with ShouldGenerateNodeIdentity true (auth error path or TTL expiry) while srv.encrypter.SignClaims errors — missing signing key, uninitialized keyring, or key metadata problems after key rotation/restore.","commonSituations":"Restored servers missing the keyring in raft; key rotation removed the active key; mixed-version cluster where encrypter state is unavailable; fresh cluster where keyring bootstrap failed.","solutions":["Check server logs for encrypter/keyring errors and ensure the signing key exists in raft","Verify all servers are upgraded past the minimum version supporting node identities","Rotate or re-bootstrap the signing key per Nomad keyring docs","Retry registration after the cluster keyring is healthy"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := client.Nodes().Register(node, nil)\nif err != nil && strings.Contains(err.Error(), \"failed to sign node identity claims\") {\n    // keyring issue: do not hammer; investigate server keyring then retry\n}","preventionTips":["Ensure the signing keyring exists in raft before enabling node identities","Follow documented key rotation procedures","Upgrade all servers to a version supporting node identity signing"],"tags":["nomad","jwt","keyring","node-identity"],"backgroundTag":"jwt-signing-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}