{"record":{"id":"c1352d913d6980a9","repo":"hashicorp/nomad","slug":"error-getting-signed-identity-for-task-s-v","errorCode":null,"errorMessage":"error getting signed identity for task %s: %v","messagePattern":"error getting signed identity for task (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/consul_hook.go","lineNumber":164,"sourceCode":"\t// Find task workload identity for Consul.\n\twidName := fmt.Sprintf(\"%s_%s\", structs.ConsulTaskIdentityNamePrefix, consulConfig.Name)\n\twid := task.GetIdentity(widName)\n\tif wid == nil {\n\t\t// Skip task if it doesn't have an identity for Consul since it doesn't\n\t\t// need a token.\n\t\treturn nil\n\t}\n\n\ttokenName := widName + \"/\" + task.Name\n\ttoken := tokens[clusterName][tokenName]\n\n\t// If no token was previously stored, create one.\n\tif token == nil {\n\t\t// Find signed workload identity.\n\t\tti := *task.IdentityHandle(wid)\n\t\tswi, err := h.widmgr.Get(ti)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error getting signed identity for task %s: %v\", task.Name, err)\n\t\t}\n\n\t\th.logger.Debug(\"logging into consul\", \"name\", ti.IdentityName, \"type\", ti.WorkloadType)\n\t\treq := consul.JWTLoginRequest{\n\t\t\tJWT:            swi.JWT,\n\t\t\tAuthMethodName: consulConfig.TaskIdentityAuthMethod,\n\t\t\tMeta: map[string]string{\n\t\t\t\t\"requested_by\": fmt.Sprintf(\"nomad_task_%s\", task.Name),\n\t\t\t\t\"node_id\":      h.alloc.NodeID,\n\t\t\t},\n\t\t}\n\n\t\ttoken, err = h.getConsulToken(consulConfig.Name, req)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to derive Consul token for task %s: %v\", task.Name, err)\n\t\t}\n\t}\n","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/consul_hook.go#L146-L182","documentation":"When no previously-derived token exists, prepareConsulTokensForTask fetches the task's signed workload identity (SPIFFE-style JWT) from the workload identity manager (widmgr). If widmgr.Get fails, the underlying error is wrapped as 'error getting signed identity for task %s'. This means Nomad could not obtain a valid signed identity for the task before logging into Consul.","triggerScenarios":"widmgr.Get returns an error, typically because the signed identity has not been delivered/rotated yet by the server, the identity was revoked, or client state storage for the alloc is unreadable.","commonSituations":"Server/identity signing issues (Nomad ACLs or workload identity signing disabled or failing); alloc restored from stale client state referencing a missing identity; timing issue where the task runs before the signed identity is distributed.","solutions":["Check the wrapped underlying error in the agent log for the root cause (e.g. signing/ACL failure)","Ensure nomad server ACL and workload-identity signing are healthy and servers are reachable","Verify nomad client data dir permissions/state for the alloc; reschedule the allocation (nomad alloc stop) to force re-signing","Upgrade Nomad if hitting a known identity-propagation bug in your version"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// before running tasks, confirm the signed identity is retrievable\nif _, err := widmgr.Get(*task.IdentityHandle(wid)); err != nil {\n    return fmt.Errorf(\"signed identity not ready: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := hook.Prerun(); err != nil {\n    if strings.Contains(err.Error(), \"error getting signed identity\") {\n        // back off briefly and retry Prerun; identity signing may be pending\n        time.Sleep(2 * time.Second)\n        err = hook.Prerun()\n    }\n}","preventionTips":["Keep Nomad servers healthy and ACL signing enabled/functional","Avoid restoring client state across Nomad versions; let allocs reschedule","Monitor server logs for identity-signing failures","Set job reschedule stanzas so transient identity issues self-heal"],"tags":["nomad","consul","workload-identity","jwt","signing"],"backgroundTag":"signed-identity-unavailable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}