{"record":{"id":"ca2bafc690c9f039","repo":"hashicorp/nomad","slug":"error-getting-signed-identity-for-service-s-v","errorCode":null,"errorMessage":"error getting signed identity for service %s: %v","messagePattern":"error getting signed identity for service (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/consul_hook.go","lineNumber":216,"sourceCode":"\t\t\tcontinue\n\t\t}\n\n\t\tclusterName := service.GetConsulClusterName(tg)\n\t\tconsulConfig, ok := h.consulConfigs[clusterName]\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"no such consul cluster: %s\", clusterName)\n\t\t}\n\n\t\t// Find signed identity workload.\n\t\tti := *service.IdentityHandle(env.ReplaceEnv)\n\t\ttokenName := service.Identity.Name\n\t\ttoken := tokens[clusterName][tokenName]\n\n\t\t// If no token was previously stored, create one.\n\t\tif token == nil {\n\t\t\tswi, err := h.widmgr.Get(ti)\n\t\t\tif err != nil {\n\t\t\t\tmErr = multierror.Append(mErr, fmt.Errorf(\n\t\t\t\t\t\"error getting signed identity for service %s: %v\",\n\t\t\t\t\tservice.Name, err,\n\t\t\t\t))\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\th.logger.Debug(\"logging into consul\", \"name\", ti.IdentityName, \"type\", ti.WorkloadType)\n\t\t\treq := consul.JWTLoginRequest{\n\t\t\t\tJWT:            swi.JWT,\n\t\t\t\tAuthMethodName: consulConfig.ServiceIdentityAuthMethod,\n\t\t\t\tMeta: map[string]string{\n\t\t\t\t\t\"requested_by\": fmt.Sprintf(\"nomad_service_%s\", ti.InterpolatedWorkloadIdentifier),\n\t\t\t\t\t\"node_id\":      h.alloc.NodeID,\n\t\t\t\t},\n\t\t\t}\n\n\t\t\ttoken, err = h.getConsulToken(clusterName, req)\n\t\t\tif err != nil {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/consul_hook.go#L198-L234","documentation":"For each Consul service with an identity, the hook fetches the signed service workload identity via widmgr.Get; failures are appended to the multierror as 'error getting signed identity for service %s'. The signed identity (JWT) is a prerequisite for the Consul JWT login, so this means Nomad could not provide a valid signed identity for the service.","triggerScenarios":"widmgr.Get fails for the service identity handle: signed identity not yet distributed, revoked, client state missing the entry, or identity signing failing on the server.","commonSituations":"Identity signing disabled or failing on Nomad servers; alloc restarted with stale hook state; service identity deleted from the job but the client still requests it; server connectivity issues preventing identity rotation.","solutions":["Inspect the underlying error in the agent log (multierror accumulates per-service failures)","Verify Nomad servers are healthy and workload-identity signing works (check server logs)","Stop and reschedule the allocation (nomad allocation stop) to force a fresh identity sign","Confirm the service block still declares a matching identity in the submitted job"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure the service declares a consul identity before prerun\nif svc.IsConsul() && svc.Identity != nil {\n    if _, err := widmgr.Get(*svc.IdentityHandle(env)); err != nil {\n        return fmt.Errorf(\"signed identity for %s not ready: %w\", svc.Name, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := hook.Prerun(); err != nil {\n    if mErr, ok := err.(*multierror.Error); ok {\n        for _, e := range mErr.Errors {\n            if strings.Contains(e.Error(), \"error getting signed identity for service\") {\n                // retry after short delay; identity may still be propagating\n            }\n        }\n    }\n}","preventionTips":["Keep Nomad servers reachable from clients so signed identities distribute promptly","Re-submit jobs when changing service identities so state stays consistent","Monitor for server-side signing errors and alert on them","Use reschedule/retry stanzas to absorb transient identity unavailability"],"tags":["nomad","consul","workload-identity","jwt","services"],"backgroundTag":"signed-identity-unavailable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}