hashicorp/nomad · error

%d/%d signing request was rejected: %v

Error message

%d/%d signing request was rejected: %v

What it means

When the server-side Alloc.SignIdentities RPC rejects exactly one of the requested workload identities, SignIdentities returns a single error embedding the rejection index, total count, and the server's rejection reason. One rejection fails the whole batch by design.

Source

Thrown at client/widmgr/signer.go:101

		QueryOptions: structs.QueryOptions{
			Region: s.region,

			// Unlike other RPCs, this one doesn't care about "subsequent
			// modifications" after an index. We only want to ensure the state
			// isn't too stale to know about this alloc, so we instruct the
			// Server to block at least until the Allocation is created.
			MinQueryIndex: minIndex - 1,
			AllowStale:    true,
			AuthToken:     authToken,
		},
	}
	reply := structs.AllocIdentitiesResponse{}
	if err := s.rpc.RPC("Alloc.SignIdentities", &args, &reply); err != nil {
		return nil, err
	}

	if n := len(reply.Rejections); n == 1 {
		return nil, fmt.Errorf(
			"%d/%d signing request was rejected: %v",
			n, len(req), reply.Rejections[0].Reason,
		)
	} else if n > 1 {
		var mErr *multierror.Error
		for _, r := range reply.Rejections {
			mErr = multierror.Append(
				fmt.Errorf(
					"%d/%d signing request was rejected: %v",
					n, len(req), r.Reason,
				))
		}
		return nil, mErr
	}

	if len(reply.SignedIdentities) == 0 {
		return nil, fmt.Errorf("empty signed identity response")
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the %v rejection reason to see why the server refused the identity.
2. Verify client/server Nomad versions match (identity signing support and format).
3. Check the allocation's workload identity configuration against server-side signing policy/ACLs.
4. Retry after the allocation/identity state converges (e.g. task updated to have valid identities).

signed, err := signer.SignIdentities(minIndex, reqs)
if err != nil {
    var rej *RejectionError // or match on message prefix
    logger.Error("identity signing rejected", "err", err)
    // surface the embedded reason; check server version and policy before retry
    return fmt.Errorf("signing failed: %w", err)
}

When it happens

Trigger: The Alloc.SignIdentities RPC succeeded at the transport level but reply.Rejections contains exactly 1 entry — the server refused to sign one identity (e.g. identity not allowed by policy, unknown workload, signing key unavailable).

Common situations: Server older/newer than client so an identity type is unsupported; ACL/policy forbids signing for that identity; the allocation changed and no longer matches the requested identity; node upgrade skew (node vs server versions).

Related errors

• failed to retrieve signed workload identity: %w
• empty signed identity response
• expected %d signed identities but received %d
• failed to fetch signed identities: %w
• no identities requested

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/9319dc8be2b5942d. Report an issue: GitHub.