What causes "error getting client config: %v" in hashicorp/nomad?

Check the wrapped %v cause for the exact config problem (bad address, missing cert file, etc.).

error getting client config: %v

Error message

error getting client config: %v

What it means

Returned by Meta.buildUIPath when m.Client() fails to construct a Nomad API client while generating a Nomad UI deep-link URL (e.g. for `nomad job inspect -open-ui` style flows). It wraps the client-construction error, which almost always stems from missing/invalid address or TLS/credential configuration rather than cluster state.

Source

Thrown at command/meta.go:625

		return hint
	}

	return fmt.Sprintf("%[1]s%[2]s%[3]s%[4]s%[5]s %[6]s%[7]s%[8]s",
		bold,
		magenta,
		uiHintDelimiter[1:], // "==> "
		description,
		resetter,
		blue,
		url,
		resetter,
	)
}

func (m *Meta) buildUIPath(route UIRoute, params map[string]string) (string, error) {
	client, err := m.Client()
	if err != nil {
		return "", fmt.Errorf("error getting client config: %v", err)
	}

	path := route.Path
	for k, v := range params {
		path = strings.ReplaceAll(path, fmt.Sprintf(":%s", k), v)
	}

	return fmt.Sprintf("%s/ui%s", client.Address(), path), nil
}

func (m *Meta) showUIPath(ctx UIHintContext) (string, error) {
	route, exists := CommandUIRoutes[ctx.Command]
	if !exists {
		return "", nil
	}

	url, err := m.buildUIPath(route, ctx.PathParams)
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

Check the wrapped %v cause for the exact config problem (bad address, missing cert file, etc.).
Set/verify NOMAD_ADDR, e.g. export NOMAD_ADDR=https://nomad.example.com:4646.
Validate TLS env vars (NOMAD_CACERT, NOMAD_CLIENT_CERT, NOMAD_CLIENT_KEY) point to readable files.
Confirm NOMAD_TOKEN is set and well-formed if ACLs are enabled.
Run `nomad node status` to confirm the client config works for other commands.

Example fix

// before
nomad job status -json webapp   # fails: NOMAD_ADDR unset
// after
export NOMAD_ADDR=https://nomad.service.consul:4646
nomad job status -json webapp

Defensive patterns

Strategy: validation

Validate before calling

: "${NOMAD_ADDR:?NOMAD_ADDR must be set, e.g. https://nomad.example.com:4646}"
[ -z "$NOMAD_CACERT" ] || [ -r "$NOMAD_CACERT" ] || { echo "NOMAD_CACERT not readable: $NOMAD_CACERT"; exit 1; }

Try / catch

url, err := meta.BuildUIPath(route, params)
if err != nil && strings.Contains(err.Error(), "error getting client config") {
    // surface config guidance rather than retrying
    return fmt.Errorf("fix NOMAD_ADDR/TLS config: %w", err)
}

Prevention

Export NOMAD_ADDR (and TLS vars) in shell profiles and CI before any nomad command.
Validate config once with a cheap command like `nomad node status`.
Keep cert/key files present and readable on the machine.
Avoid mixing env vars from different clusters in shared environments.

When it happens

Trigger: Any command path that builds a UI route where the Meta's Client() call errors: NOMAD_ADDR unset or malformed (bad URL scheme), invalid NOMAD_CACERT/NOMAD_CLIENT_CERT paths, unparsable TLS config, or bad secret ID format in NOMAD_TOKEN.

Common situations: Running the CLI outside a scheduled environment where NOMAD_ADDR was never exported; typo'd https:// address or missing port; cert files removed or unreadable; mixing env vars from different clusters in CI.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/e407ada467893936. Report an issue: GitHub.