hashicorp/nomad · error

client_introduction.enforcement must be one of %v

Error message

client_introduction.enforcement must be one of %v

What it means

The `client_introduction` block's `enforcement` field must be set and must be one of the allowed values in ClientIntroductionEnforcementValues. Nomad validates this when parsing agent config and rejects unknown or empty values.

Source

Thrown at command/agent/config.go:1264

		result.ExtraKeysHCL = append(result.ExtraKeysHCL, z.ExtraKeysHCL...)
	}

	return &result
}

// Validate performs validation on the ClientIntroduction configuration block to
// ensure the values are set correctly for use by the server.
func (c *ClientIntroduction) Validate() error {

	if c == nil {
		return nil
	}

	if c.Enforcement == "" {
		return errors.New("client_introduction.enforcement must be set")
	}
	if !slices.Contains(ClientIntroductionEnforcementValues, c.Enforcement) {
		return fmt.Errorf("client_introduction.enforcement must be one of %v",
			ClientIntroductionEnforcementValues)
	}

	if c.DefaultIdentityTTL < 1 {
		return errors.New("client_introduction.default_identity_ttl must be greater one")
	}
	if c.MaxIdentityTTL < 1 {
		return errors.New("client_introduction.max_identity_ttl must be greater one")
	}
	if c.MaxIdentityTTL < c.DefaultIdentityTTL {
		return errors.New("client_introduction.max_identity_ttl must be greater than default_identity_ttl")
	}

	return nil
}

// ServerJoin is used in both clients and servers to bootstrap connections to
// servers

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set enforcement to one of the values listed in ClientIntroductionEnforcementValues (check the docs for your Nomad version).
2. Fix casing/typos in the enforcement value.
3. If you don't need client introduction, remove the block entirely.

Example fix

// before
client_introduction {
  enforcement = "permisive"
}
// after
client_introduction {
  enforcement = "permissive" // must be one of the documented values
}

allowed := ClientIntroductionEnforcementValues
if !slices.Contains(allowed, cfg.ClientIntroduction.Enforcement) {
  return fmt.Errorf("enforcement must be one of %v", allowed)
}

When it happens

Trigger: Config contains `client_introduction { enforcement = "..." }` with a value not in the allowed set (typo, wrong case) or enforcement omitted entirely (caught by the adjacent "must be set" error).

Common situations: Typos in the enforcement value; copying docs from a different Nomad version where allowed values differ; leaving the field blank while enabling client_introduction.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• wait config is nil or empty
• missing datacenter for client registration
• default_identity_ttl must be greater than 0
• max_identity_ttl must be greater than 0
• max_identity_ttl must be greater than or equal to default_id

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/555ac46326ee297c. Report an issue: GitHub.