{"record":{"id":"e700bd5a89504ce5","repo":"hashicorp/nomad","slug":"tasks-can-only-have-1-identity-block-until-all-ser","errorCode":null,"errorMessage":"tasks can only have 1 identity block until all servers are upgraded to %s or later","messagePattern":"tasks can only have 1 identity block until all servers are upgraded to (.+?) or later","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint_hooks.go","lineNumber":536,"sourceCode":"\tif job.Priority < structs.JobMinPriority || job.Priority > v.srv.config.JobMaxPriority {\n\t\tmultierror.Append(validationErrors, fmt.Errorf(\"job priority must be between [%d, %d]\", structs.JobMinPriority, v.srv.config.JobMaxPriority))\n\t}\n\n\tokForIdentity := v.isEligibleForMultiIdentity()\n\n\ttotalCount := 0\n\tfor _, tg := range job.TaskGroups {\n\t\ttotalCount += tg.Count\n\n\t\tfor _, s := range tg.Services {\n\t\t\tserviceErrs := v.validateServiceIdentity(\n\t\t\t\ts, fmt.Sprintf(\"task group %s\", tg.Name), okForIdentity)\n\t\t\tmultierror.Append(validationErrors, serviceErrs)\n\t\t}\n\n\t\tfor _, t := range tg.Tasks {\n\t\t\tif len(t.Identities) > 1 && !okForIdentity {\n\t\t\t\tmultierror.Append(validationErrors, fmt.Errorf(\"tasks can only have 1 identity block until all servers are upgraded to %s or later\", minVersionMultiIdentities))\n\t\t\t}\n\t\t\tfor _, s := range t.Services {\n\t\t\t\tserviceErrs := v.validateServiceIdentity(\n\t\t\t\t\ts, fmt.Sprintf(\"task %s\", t.Name), okForIdentity)\n\t\t\t\tmultierror.Append(validationErrors, serviceErrs)\n\t\t\t}\n\n\t\t\tvaultWarns, vaultErrs := v.validateVaultIdentity(t, okForIdentity)\n\t\t\tmultierror.Append(validationErrors, vaultErrs)\n\t\t\twarnings = append(warnings, vaultWarns...)\n\t\t}\n\t}\n\tif v.srv.config.JobMaxCount > 0 && totalCount > v.srv.config.JobMaxCount {\n\t\terr := fmt.Errorf(\"total count was greater than configured job_max_count: %d > %d\", totalCount, v.srv.config.JobMaxCount)\n\t\tmultierror.Append(validationErrors, err)\n\t}\n\n\treturn warnings, validationErrors.ErrorOrNil()","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint_hooks.go#L518-L554","documentation":"Workload identity support for multiple identity blocks per task requires every server in the region to run at least minVersionMultiIdentities. Until the whole cluster is upgraded, tasks are limited to a single identity block.","triggerScenarios":"Validating/registering a job where any task's identities array has more than one entry while ServersMeetMinimumVersion reports some server below the required version.","commonSituations":"Mixed-version clusters during rolling upgrades; submitting new-style jobs (multiple WIDs for vault/consul) before finishing server upgrades; staging clusters lagging production versions.","solutions":["Upgrade all servers to the minimum multi-identity version, then resubmit the job","Collapse the task's identities to a single block temporarily","Use legacy vault/consul stanza integration instead of multiple workload identities until upgraded"],"exampleFix":"// before\nidentities: [{name:\"vault_x\"},{name:\"consul_y\"}]\n// after\nidentities: [{name:\"vault_x\"}]  # until servers >= min version","handlingStrategy":"validation","validationCode":"for _, tg := range job.TaskGroups {\n\tfor _, t := range tg.Tasks {\n\t\tif len(t.Identities) > 1 {\n\t\t\treturn fmt.Errorf(\"task %s uses %d identities; requires multi-identity cluster\", t.Name, len(t.Identities))\n\t\t}\n\t}\n}","typeGuard":"func multiIdentitySafe(tasks []*api.Task) bool {\n\treturn !slices.ContainsFunc(tasks, func(t *api.Task) bool { return len(t.Identities) > 1 })\n}","tryCatchPattern":null,"preventionTips":["Verify all servers meet the multi-identity version before deploying such jobs","Gate new job features behind cluster version checks in CI"],"tags":["nomad","workload-identity","version-skew","rolling-upgrade"],"backgroundTag":"server-version-skew","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}