hashicorp/nomad · error
[✘] Could not create Vault policy: %w
Error message
[✘] Could not create Vault policy: %w
What it means
Fires in createPolicy when the Vault sys/policies/acl write for the Nomad-generated policy fails (Vault unreachable, wrong token, or insufficient permissions), so workload identity policy setup aborts.
Source
Thrown at command/setup_vault.go:487
return renderVaultPolicy(string(vaultPolicyBody), accessor, s.kvPath), nil
}
func renderVaultPolicy(policyBody, accessor, kvPath string) string {
policyText := strings.ReplaceAll(policyBody, "auth_jwt_X", accessor)
mount := strings.Trim(kvPath, "/")
return strings.ReplaceAll(policyText, "secret/", mount+"/")
}
func (s *SetupVaultCommand) createPolicy(policyText string) error {
encoded := base64.StdEncoding.EncodeToString([]byte(policyText))
policyBody := fmt.Sprintf(`{"policy": "%s"}`, encoded)
buf := []byte(policyBody)
path := "sys/policies/acl/" + vaultPolicyName
_, err := s.vLogical.WriteBytes(path, buf)
if err != nil {
return fmt.Errorf("[✘] Could not create Vault policy: %w", err)
}
s.Ui.Info(fmt.Sprintf("[✔] Created policy %q.", vaultPolicyName))
return nil
}
func (s *SetupVaultCommand) authMethodExists() bool {
existingConf, _ := s.vLogical.Read(fmt.Sprintf("/auth/%s/config", vaultPath))
return existingConf != nil
}
func (s *SetupVaultCommand) renderAuthMethod() (map[string]any, error) {
authConfig := map[string]any{}
err := json.Unmarshal(vaultAuthConfigBody, &authConfig)
if err != nil {
return nil, fmt.Errorf("default auth config text could not be deserialized: %v", err)
}View on GitHub (pinned to 482b49bf1a)
Solutions
- Grant the Vault token create/update on sys/policies/acl/*
- Confirm Vault address, namespace, and unsealed state
- Inspect the underlying Vault API error for the exact rejection reason
Defensive patterns
Strategy: try-catch
Validate before calling
// pre-check: vault token capabilities sys/policies/acl/<name> # expect: create/update
Try / catch
var apiErr *api.ResponseError
if errors.As(err, &apiErr) {
// log apiErr.StatusCode (403 => permissions, 503 => sealed/unreachable)
} Prevention
- Use a token with policy-management privileges for setup
- Check vault status before running setup
- Validate the rendered policy JSON before writing
When it happens
Trigger: s.vLogical.WriteBytes("sys/policies/acl/<vaultPolicyName>", buf) errors — token lacks create/update on sys/policies/acl, Vault unreachable, or the policy payload is rejected.
Common situations: Token without sudo/root-like privileges to manage ACL policies; Vault sealed or wrong address/namespace; malformed policy body produced upstream.
Related errors
- [✘] Could not create Vault role: %w
- [✘] Could not retrieve JWT accessor: %w
- [✘] Could not write namespace %q: %w
- failed to recover vault token from %s: %v
- failed to write vault token to secrets dir: %v
AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04).
Data as JSON: /api/errors/67c92648786203d9.
Report an issue: GitHub.