{"record":{"id":"c5a1222dce424f61","repo":"hashicorp/nomad","slug":"failed-to-load-si-token-for-native-task-s-w","errorCode":null,"errorMessage":"failed to load SI token for native task %s: %w","messagePattern":"failed to load SI token for native task (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/connect_native_hook.go","lineNumber":277,"sourceCode":"// directory AND the CONSUL_HTTP_TOKEN environment variable is not already set.\n//\n// Following the pattern of the envoy_bootstrap_hook, the Consul Service Identity\n// ACL Token is generated prior to this hook, if Consul ACLs are enabled. This is\n// done in the sids_hook, which places the token at secrets/si_token in the task\n// workspace. The content of that file is the SI token specific to this task\n// instance.\nfunc (h *connectNativeHook) maybeSetSITokenEnv(dir, task string, env map[string]string) error {\n\tif _, exists := env[\"CONSUL_HTTP_TOKEN\"]; exists {\n\t\t// Consul token was already set - typically by using the Vault integration\n\t\t// and a template block to set the environment. Ignore the SI token as\n\t\t// the configured token takes precedence.\n\t\treturn nil\n\t}\n\n\ttoken, err := os.ReadFile(filepath.Join(dir, sidsTokenFile))\n\tif err != nil {\n\t\tif !os.IsNotExist(err) {\n\t\t\treturn fmt.Errorf(\"failed to load SI token for native task %s: %w\", task, err)\n\t\t}\n\t\th.logger.Trace(\"no SI token to load for native task\", \"task\", task)\n\t\treturn nil // token file DNE; acls not enabled\n\t}\n\th.logger.Trace(\"recovered pre-existing SI token for native task\", \"task\", task)\n\tenv[\"CONSUL_HTTP_TOKEN\"] = string(token)\n\treturn nil\n}\n","sourceCodeStart":259,"sourceCodeEnd":286,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/connect_native_hook.go#L259-L286","documentation":"maybeSetSITokenEnv failed reading the Consul Service Identity token from secrets/si_token in the task workspace (file missing/unreadable) while setting CONSUL_HTTP_TOKEN for a Connect Native task, so the task cannot authenticate to Consul via the hook.","triggerScenarios":"Thrown at client/allocrunner/taskrunner/connect_native_hook.go:277 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify Consul ACLs are enabled consistently between server/client config","Check the sids_hook ran and wrote secrets/si_token before this hook","Confirm SI token generation succeeded in server logs","Set CONSUL_HTTP_TOKEN explicitly in the task env as a workaround"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}