{"record":{"id":"d901800ffb16d5d4","repo":"hashicorp/nomad","slug":"task-s-uses-vault-cluster-s-but-does-not-have-an","errorCode":null,"errorMessage":"Task %s uses Vault cluster %s but does not have an identity named %s and no default identity is provided in agent configuration","messagePattern":"Task (.+?) uses Vault cluster (.+?) but does not have an identity named (.+?) and no default identity is provided in agent configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hooks.go","lineNumber":605,"sourceCode":"\t\tfor _, wid := range t.Identities {\n\t\t\tif strings.HasPrefix(wid.Name, structs.WorkloadIdentityVaultPrefix) {\n\t\t\t\twarnings = append(warnings, fmt.Errorf(\"Task %s has an identity called %s but no vault block\", t.Name, wid.Name))\n\t\t\t}\n\t\t}\n\t\treturn warnings, nil\n\t}\n\n\tvaultWIDName := t.Vault.IdentityName()\n\tvaultWID := t.GetIdentity(vaultWIDName)\n\n\tif vaultWID != nil && !okForIdentity {\n\t\treturn warnings, fmt.Errorf(\"Task %s cannot have an identity for Vault until all servers are upgraded to %s or later\", t.Name, minVersionMultiIdentities)\n\t}\n\n\tif vaultWID == nil {\n\t\t// Tasks using non-default clusters are required to have an identity.\n\t\tif t.Vault.Cluster != structs.VaultDefaultCluster {\n\t\t\treturn warnings, fmt.Errorf(\n\t\t\t\t\"Task %s uses Vault cluster %s but does not have an identity named %s and no default identity is provided in agent configuration\",\n\t\t\t\tt.Name, t.Vault.Cluster, vaultWIDName,\n\t\t\t)\n\t\t}\n\n\t\treturn warnings, nil\n\t}\n\n\treturn warnings, nil\n}\n\ntype memoryOversubscriptionValidate struct {\n\tsrv *Server\n}\n\nfunc (*memoryOversubscriptionValidate) Name() string {\n\treturn \"memory_oversubscription\"\n}","sourceCodeStart":587,"sourceCodeEnd":623,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hooks.go#L587-L623","documentation":"Tasks that use a non-default Vault cluster (t.Vault.Cluster != structs.VaultDefaultCluster) must carry a workload identity named via t.Vault.IdentityName(). If no such identity exists on the task and no default identity is supplied in agent configuration, validation fails because Nomad cannot determine which Vault identity/cluster credentials to use for the task.","triggerScenarios":"Submitting a job where a task sets vault.cluster = \"my-cluster\" (non-default) but defines no identity with the Vault identity name and no default identity is configured agent-side. Raised in validateVaultIdentity when vaultWID == nil.","commonSituations":"Misconfigured job spec referencing an alternate Vault cluster without the required identity block; forgetting that non-default clusters mandate identities; typo in identity name so GetIdentity lookup misses; agent config lacking the default identity.","solutions":["Add an identity block named t.Vault.IdentityName() (e.g. name = \"vault_<cluster>\") to the task","Configure a default Vault identity in the Nomad agent configuration","Remove the vault.cluster override to use the default cluster, which does not require an explicit identity"],"exampleFix":"// before\nvault { cluster = \"prod-vault\" } // no identity\n// after\nvault { cluster = \"prod-vault\" }\nidentity { name = \"vault_prod-vault\" aud = [\"vault.io/audience/prod\"] env = false file = true }","handlingStrategy":"validation","validationCode":"// before submit\nif task.Vault != nil && task.Vault.Cluster != \"default\" {\n  names := identityNames(task.Identities)\n  if !contains(names, \"vault_\"+task.Vault.Cluster) {\n    return fmt.Errorf(\"task %s needs identity vault_%s\", task.Name, task.Vault.Cluster)\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair non-default vault.cluster with a matching identity block","Lint job HCL for vault cluster/identity pairing before running","Verify identity name matches t.Vault.IdentityName() exactly (cluster-suffixed)"],"tags":["nomad","vault","workload-identity","job-validation","missing-identity"],"backgroundTag":"missing-workload-identity","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}