{"record":{"id":"ca445de7f74090a9","repo":"hashicorp/nomad","slug":"an-empty-string-is-an-invalid-audience-d","errorCode":null,"errorMessage":"an empty string is an invalid audience (%d)","messagePattern":"an empty string is an invalid audience \\((.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":465,"sourceCode":"\t\twi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)\n\t}\n}\n\nfunc (wi *WorkloadIdentity) Validate() error {\n\tif wi == nil {\n\t\treturn fmt.Errorf(\"must not be nil\")\n\t}\n\n\tvar mErr multierror.Error\n\n\tif !validIdentityName.MatchString(wi.Name) {\n\t\terr := fmt.Errorf(\"invalid name %q. Must match regex %s\", wi.Name, validIdentityName)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\tfor i, aud := range wi.Audience {\n\t\tif aud == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"an empty string is an invalid audience (%d)\", i+1))\n\t\t}\n\t}\n\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.\n\t\tif wi.ChangeSignal != \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"can only use change_signal=%q with change_mode=%q\",\n\t\t\t\twi.ChangeSignal, WIChangeModeSignal))\n\t\t}\n\tcase WIChangeModeSignal:\n\t\tif wi.ChangeSignal == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"change_signal must be specified when using change_mode=%q\", WIChangeModeSignal))\n\t\t}\n\tdefault:\n\t\t// Unknown change_mode\n\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"invalid change_mode: %s\", wi.ChangeMode))\n\t}","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L447-L483","documentation":"WorkloadIdentity.Validate rejects empty strings in the identity's Audience list, emitting this error with the 1-based position of the offending entry. Audiences are JWT audiences for the identity's token and must each be non-empty.","triggerScenarios":"Validate() on a WorkloadIdentity whose Audience slice contains an empty string at index i — typically rendered from an empty template variable or a trailing comma in a list.","commonSituations":"HCL list built by joining strings with an empty element; env-var-driven audience lists where a variable was unset; YAML/JSON conversion leaving empty values.","solutions":["Remove the empty entry from the audience list (the error tells you which position, 1-based).","Filter empty strings when constructing audiences programmatically.","Fix the unset variable or template that rendered an empty audience."],"exampleFix":"// before\naudience = [\"api\", \"\"]\n// after\naudience = [\"api\"]","handlingStrategy":"validation","validationCode":"for i, aud := range wi.Audience {\n    if aud == \"\" {\n        return fmt.Errorf(\"audience %d is empty\", i+1)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Filter empty strings from audience lists before assignment.","Avoid trailing-comma list construction in templates.","Fail loudly when an audience env var is unset."],"tags":["nomad","workload-identity","validation","jwt"],"backgroundTag":"missing-required-argument","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}