hashicorp/nomad · error

default auth config text could not be deserialized: %v

Error message

default auth config text could not be deserialized: %v

What it means

renderAuthMethod deserializes the embedded default JWT auth config (vaultAuthConfigBody) into a map. This error means the compiled-in JSON constant itself failed to unmarshal — a build-time asset problem, not user input.

Source

Thrown at command/setup_vault.go:504

	if err != nil {
		return fmt.Errorf("[✘] Could not create Vault policy: %w", err)
	}

	s.Ui.Info(fmt.Sprintf("[✔] Created policy %q.", vaultPolicyName))

	return nil
}

func (s *SetupVaultCommand) authMethodExists() bool {
	existingConf, _ := s.vLogical.Read(fmt.Sprintf("/auth/%s/config", vaultPath))
	return existingConf != nil
}

func (s *SetupVaultCommand) renderAuthMethod() (map[string]any, error) {
	authConfig := map[string]any{}
	err := json.Unmarshal(vaultAuthConfigBody, &authConfig)
	if err != nil {
		return nil, fmt.Errorf("default auth config text could not be deserialized: %v", err)
	}

	authConfig["jwks_url"] = s.jwksURL
	authConfig["default_role"] = vaultRole

	if s.jwksCACertPath != "" {
		caCert, err := os.ReadFile(s.jwksCACertPath)
		if err != nil {
			return nil, fmt.Errorf("could not read -jwks-certfile: %v", err)
		}
		authConfig["jwks_ca_pem"] = string(caCert)
	}

	return authConfig, nil
}

func (s *SetupVaultCommand) createAuthMethod(authConfig map[string]any) error {
	err := s.vClient.Sys().EnableAuthWithOptions(vaultPath, &api.MountInput{Type: "jwt"})

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Rebuild nomad-setup from a clean checkout so the embedded JSON constant is intact
2. Validate the vaultAuthConfigBody constant with a JSON linter or go test
3. Avoid hand-editing embedded JSON assets in the source

Example fix

// before (embedded constant edited by hand)
const vaultAuthConfigBody = `{"jwks_url": "", "default_role": "",}`
// after
const vaultAuthConfigBody = `{"jwks_url": "", "default_role": ""}`

var probe map[string]any
if err := json.Unmarshal(vaultAuthConfigBody, &probe); err != nil {
    // embedded config constant is corrupt; rebuild binary
}

When it happens

Trigger: json.Unmarshal(vaultAuthConfigBody, &authConfig) fails because the embedded JSON constant is malformed (e.g. broken during code generation or an edit).

Common situations: Patched or incorrectly generated binary where the embedded config string was corrupted; virtually never caused by runtime user configuration.

Understand the failure class

Background: "failed to unmarshal" / json.Unmarshal errors: why parsing a response into a Go struct fails and how to fix it — this error's family across 23 libraries.

Related errors

• unexpected ExpirationLeeway type: %v
• unexpected NotBeforeLeeway type: %v
• unexpected ClockSkewLeeway type: %v
• failed to encode bootstrap environment: %w
• error parsing fingerprint output as json: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0a67baa0d6cdfae0. Report an issue: GitHub.