{"record":{"id":"c0c734940370f34d","repo":"hashicorp/nomad","slug":"multi-cluster-vault-is-unlicensed","errorCode":null,"errorMessage":"Multi-Cluster Vault is unlicensed.","messagePattern":"Multi-Cluster Vault is unlicensed\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs_ce.go","lineNumber":30,"sourceCode":"\tmultierror \"github.com/hashicorp/go-multierror\"\n)\n\nfunc (n *Namespace) Canonicalize() {}\n\nfunc (n *NamespaceNodePoolConfiguration) Canonicalize() {}\n\nfunc (n *NamespaceNodePoolConfiguration) Validate() error {\n\tif n != nil {\n\t\treturn errors.New(\"Node Pools Governance is unlicensed.\")\n\t}\n\treturn nil\n}\n\nfunc (n *NamespaceVaultConfiguration) Canonicalize() {}\n\nfunc (n *NamespaceVaultConfiguration) Validate() error {\n\tif n != nil {\n\t\treturn errors.New(\"Multi-Cluster Vault is unlicensed.\")\n\t}\n\treturn nil\n}\n\nfunc (n *NamespaceConsulConfiguration) Canonicalize() {}\n\nfunc (n *NamespaceConsulConfiguration) Validate() error {\n\tif n != nil {\n\t\treturn errors.New(\"Multi-Cluster Consul is unlicensed.\")\n\t}\n\treturn nil\n}\n\nfunc (m *Multiregion) Validate(jobType string, jobDatacenters []string) error {\n\tif m != nil {\n\t\treturn errors.New(\"Multiregion jobs are unlicensed.\")\n\t}\n","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs_ce.go#L12-L48","documentation":"NamespaceVaultConfiguration.Validate in the CE build rejects any non-nil multi-cluster Vault namespace configuration with \"Multi-Cluster Vault is unlicensed.\" This feature (per-namespace Vault configuration allowing different Vault clusters/namespaces per Nomad namespace) is enterprise-only, so the OSS binary hard-fails whenever the block is present.","triggerScenarios":"Creating or updating a namespace where NamespaceVaultConfiguration is non-nil (e.g. vault { cluster = \"...\" default_namespace = \"...\" } inside a namespace stanza) against a community-edition agent.","commonSituations":"Applying namespace specs dumped from an Enterprise cluster to OSS; enabling multi-cluster Vault docs examples without an Enterprise license; IaC modules that always render the vault block.","solutions":["Remove the vault configuration block from the namespace, keeping cluster-level Vault integration instead.","Switch to Nomad Enterprise with a license covering Multi-Cluster Vault.","Set the NamespaceVaultConfiguration field to nil in tooling that builds namespace payloads."],"exampleFix":"// before\nns.VaultConfiguration = &structs.NamespaceVaultConfiguration{DefaultNamespace: \"admin\"}\n// after\nns.VaultConfiguration = nil // Multi-Cluster Vault requires Enterprise license","handlingStrategy":"validation","validationCode":"if ns.VaultConfiguration != nil {\n\treturn errors.New(\"multi-cluster vault requires Nomad Enterprise\")\n}","typeGuard":"func vaultLicensed(cfg *structs.NamespaceVaultConfiguration) bool { return cfg == nil }","tryCatchPattern":"if err := ns.Validate(); err != nil && strings.Contains(err.Error(), \"unlicensed\") {\n\tns.VaultConfiguration = nil // retry without the block\n}","preventionTips":["Do not copy per-namespace vault blocks into OSS clusters","Gate IaC modules on cluster edition detection","Configure Vault integration at the agent level on OSS"],"tags":["nomad","licensing","enterprise","vault"],"backgroundTag":"feature-unlicensed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}