hashicorp/nomad · error

an empty string is an invalid audience (%d)

Error message

an empty string is an invalid audience (%d)

What it means

WorkloadIdentity.Validate rejects empty strings in the identity's Audience list, emitting this error with the 1-based position of the offending entry. Audiences are JWT audiences for the identity's token and must each be non-empty.

Source

Thrown at nomad/structs/workload_id.go:465

		wi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)
	}
}

func (wi *WorkloadIdentity) Validate() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

	var mErr multierror.Error

	if !validIdentityName.MatchString(wi.Name) {
		err := fmt.Errorf("invalid name %q. Must match regex %s", wi.Name, validIdentityName)
		mErr.Errors = append(mErr.Errors, err)
	}

	for i, aud := range wi.Audience {
		if aud == "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("an empty string is an invalid audience (%d)", i+1))
		}
	}

	switch wi.ChangeMode {
	case "", WIChangeModeNoop, WIChangeModeRestart:
		// Treat "" as noop. Make sure signal isn't set.
		if wi.ChangeSignal != "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("can only use change_signal=%q with change_mode=%q",
				wi.ChangeSignal, WIChangeModeSignal))
		}
	case WIChangeModeSignal:
		if wi.ChangeSignal == "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("change_signal must be specified when using change_mode=%q", WIChangeModeSignal))
		}
	default:
		// Unknown change_mode
		mErr.Errors = append(mErr.Errors, fmt.Errorf("invalid change_mode: %s", wi.ChangeMode))
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the empty entry from the audience list (the error tells you which position, 1-based).
2. Filter empty strings when constructing audiences programmatically.
3. Fix the unset variable or template that rendered an empty audience.

Example fix

// before
audience = ["api", ""]
// after
audience = ["api"]

for i, aud := range wi.Audience {
    if aud == "" {
        return fmt.Errorf("audience %d is empty", i+1)
    }
}

When it happens

Trigger: Validate() on a WorkloadIdentity whose Audience slice contains an empty string at index i — typically rendered from an empty template variable or a trailing comma in a list.

Common situations: HCL list built by joining strings with an empty element; env-var-driven audience lists where a variable was unset; YAML/JSON conversion leaving empty values.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Service identity must provide at least one target aud value
• no signed workload identity available
• JWT auth method requires either OIDCDiscoveryURL, or JWKS UR
• missing Audience
• PrivateKey is required for `private_key` KeySource

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/ca445de7f74090a9. Report an issue: GitHub.