hashicorp/nomad · error

[✘] Could not retrieve JWT accessor: %w

Error message

[✘] Could not retrieve JWT accessor: %w

What it means

renderPolicy reads sys/auth/<path> to obtain the JWT auth method's accessor, needed to render the Nomad policy. The read failing is wrapped as 'Could not retrieve JWT accessor'. Additionally the type assertion on Data["accessor"] follows the read.

Source

Thrown at command/setup_vault.go:466

	_, err = s.vLogical.WriteBytes(path, buf)
	if err != nil {
		return fmt.Errorf("[✘] Could not create Vault role: %w", err)
	}

	s.Ui.Info(fmt.Sprintf("[✔] Created role %q.", vaultRole))
	return nil
}

func (s *SetupVaultCommand) policyExists() bool {
	existingPolicies, _ := s.vClient.Sys().ListPolicies()
	return slices.Contains(existingPolicies, vaultPolicyName)
}

func (s *SetupVaultCommand) renderPolicy() (string, error) {
	secret, err := s.vLogical.Read("sys/auth/" + vaultPath)
	if err != nil {
		return "", fmt.Errorf("[✘] Could not retrieve JWT accessor: %w", err)
	}
	accessor := secret.Data["accessor"].(string)

	return renderVaultPolicy(string(vaultPolicyBody), accessor, s.kvPath), nil
}

func renderVaultPolicy(policyBody, accessor, kvPath string) string {
	policyText := strings.ReplaceAll(policyBody, "auth_jwt_X", accessor)
	mount := strings.Trim(kvPath, "/")
	return strings.ReplaceAll(policyText, "secret/", mount+"/")
}

func (s *SetupVaultCommand) createPolicy(policyText string) error {
	encoded := base64.StdEncoding.EncodeToString([]byte(policyText))
	policyBody := fmt.Sprintf(`{"policy": "%s"}`, encoded)
	buf := []byte(policyBody)

	path := "sys/policies/acl/" + vaultPolicyName

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Enable the JWT auth method first (run the auth-method creation step) before rendering the policy
2. Grant the token read capability on sys/auth and sys/auth/*
3. Verify -vault-path matches the path where JWT auth is mounted
4. Check Vault connectivity and unsealed state

// pre-check: mount exists
// vault auth list | grep <path>  AND vault token capabilities sys/auth/<path>  # expect: read

var apiErr *api.ResponseError
if errors.As(err, &apiErr) && apiErr.StatusCode == 403 {
    // token lacks sys/auth read; escalate privileges
}

When it happens

Trigger: s.vLogical.Read("sys/auth/<vaultPath>") errors — JWT auth method not yet enabled at that path, token lacks access to sys/auth, or Vault connection failure.

Common situations: Running policy rendering before the JWT backend was enabled; token without sudo on sys/auth; wrong vaultPath flag; Vault sealed.

Related errors

• [✘] Could not create Vault policy: %w
• [✘] Could not enable JWT credential backend: %w
• no signed workload identity available
• JWT login returned an empty secret
• JWT login did not return a token

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/71186c530ae798c0. Report an issue: GitHub.