hashicorp/nomad · error

[✘] Could not create Vault auth method: %w

Error message

[✘] Could not create Vault auth method: %w

What it means

The write of the JWT auth method config to auth/<path>/config failed. A special case is handled inline: if Vault's error mentions 'error checking jwks URL', the command prints a targeted message and exits; all other write errors are wrapped with this message.

Source

Thrown at command/setup_vault.go:539

func (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {
	err := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: "jwt"})
	if err != nil {
		return fmt.Errorf("[✘] Could not enable JWT credential backend: %w", err)
	}

	buf, err := json.Marshal(authConfig)
	if err != nil {
		return fmt.Errorf("auth method could not be interpolated with args: %w", err)
	}
	_, err = s.vLogical.WriteBytes(fmt.Sprintf("auth/%s/config", vaultPath), buf)
	if err != nil {
		if strings.Contains(err.Error(), "error checking jwks URL") {
			s.Ui.Error(fmt.Sprintf(
				"error: Nomad JWKS endpoint unreachable, verify that Nomad is running and that the JWKS URL %s is reachable by Vault", s.jwksURL,
			))
			os.Exit(1)
		}
		return fmt.Errorf("[✘] Could not create Vault auth method: %w", err)
	}

	s.Ui.Info(fmt.Sprintf("[✔] Created JWT auth method %q.", vaultPath))
	return nil
}

// namespaceExists takes checks if ns exists. if destroy is true, it will check
// for custom metadata presence to prevent deleting a namespace we didn't
// create.
func (s *SetupVaultCommand) namespaceExists(ns string, destroy bool) bool {
	s.vClient.SetNamespace("")
	defer s.vClient.SetNamespace(s.ns)

	existingNamespace, _ := s.vLogical.Read(fmt.Sprintf("/sys/namespaces/%s", ns))
	if destroy && existingNamespace != nil {
		if m, ok := existingNamespace.Data["custom_metadata"]; ok {
			if mm, ok := m.(map[string]any)["created-by"]; ok {
				return mm == "nomad-setup"

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the JWKS URL is reachable from Vault first (this is the most common rejection path, handled with the dedicated exit message)
2. Check the token has update on auth/<path>/config
3. Validate oidc_discovery_url / jwks_url formatting and scheme
4. Inspect the wrapped underlying Vault error for the API's reason

// pre-check JWKS reachability before setup:
// curl -fsS --cacert <ca> "$JWKS_URL" > /dev/null || echo unreachable

var apiErr *api.ResponseError
if errors.As(err, &apiErr) {
    // StatusCode 400 with jwks issues => fix jwks_url / network from Vault
    // StatusCode 403 => token permissions on auth/<path>/config
}

When it happens

Trigger: s.vLogical.WriteBytes("auth/<path>/config", buf) errors other than the JWKS-check case: token lacks update on the config path, invalid config values, or Vault API failure.

Common situations: Wrong jwks_url value rejected by Vault; token permissions insufficient; Vault sealed or unreachable; OIDC configuration fields invalid.

Related errors

• no signed workload identity available
• JWT login returned an empty secret
• JWT login did not return a token
• No addresses found, please configure one.
• failed to parse signal: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4d78a68d42b505c3. Report an issue: GitHub.