consul tokens for cluster %s and identity %s requested by ta

Error message

consul tokens for cluster %s and identity %s requested by task %s not found

What it means

A variant of the cluster-level token lookup failure: tokens for the Consul cluster exist, but not for the specific workload identity name (consulWIDName) requested by this task. The per-identity key lookup clusterTokens[consulWIDName+"/"+req.Task.Name] returned nil.

Source

Thrown at client/allocrunner/taskrunner/template_hook.go:166

	// will try to pick it up from the environment; we want to enforce that we
	// don't have a Consul token unless intentionally configured
	h.consulToken = "invalid-token"

	if hasConsulIdentity {
		consulCluster := req.Task.GetConsulClusterName(tg)
		consulTokens := h.config.hookResources.GetConsulTokens()
		clusterTokens := consulTokens[consulCluster]

		if clusterTokens == nil {
			return fmt.Errorf(
				"consul tokens for cluster %s requested by task %s not found",
				consulCluster, req.Task.Name,
			)
		}

		consulToken := clusterTokens[consulWIDName+"/"+req.Task.Name]
		if consulToken == nil {
			return fmt.Errorf(
				"consul tokens for cluster %s and identity %s requested by task %s not found",
				consulCluster, consulWIDName, req.Task.Name,
			)
		}

		h.consulToken = consulToken.SecretID
	} else if h.config.clientConfig.TemplateConfig != nil &&
		h.config.clientConfig.TemplateConfig.UseClientConsulToken {
		consulCluster := req.Task.GetConsulClusterName(tg)
		if config, ok := h.config.clientConfig.ConsulConfigs[consulCluster]; ok {
			h.consulToken = config.Token
		} else {
			h.consulToken = ""
		}
	}

	// Set vault namespace if specified
	if req.Task.Vault != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

Confirm the task's consul identity name matches the identity configured in the server's Consul config entries
Check server logs for consul token derivation errors for this specific identity
Redeploy the job so hook resources are rebuilt with all identities
Verify the Consul cluster name and identity name spellings in the job spec

Defensive patterns

Strategy: validation

Validate before calling

// confirm the per-identity token exists before use
clusterTokens := consulTokens[consulCluster]
tok, ok := clusterTokens[consulWIDName+"/"+task.Name]
if !ok || tok == nil {
    return fmt.Errorf("identity %q not derived for cluster %q", consulWIDName, consulCluster)
}

Try / catch

consulToken := clusterTokens[consulWIDName+"/"+req.Task.Name]
if consulToken == nil {
    return fmt.Errorf("identity %q for cluster %q not derived — check server-side identity config for task %q", consulWIDName, consulCluster, req.Task.Name)
}

Prevention

Never rename a task or its identity block without a fresh deployment
Ensure every consul identity used by tasks exists in the server's Consul configuration
Use templated policies/names consistently across clusters
Test with a single identity before scaling to multi-identity setups

When it happens

Trigger: GetConsulTokens returned a non-nil map for the cluster, but no token was derived under the key '<identity-name>/<task-name>' — e.g. the task's identity name doesn't match the identity the server derived tokens for, or only some identities were populated.

Common situations: Renaming a task or its identity block without re-deriving tokens; multiple consul identities where only one is configured server-side; partial failures during token derivation.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/6c47666271a6bf66. Report an issue: GitHub.