hashicorp/nomad · error

error getting signed identity for service %s: %v

Error message

error getting signed identity for service %s: %v

What it means

For each Consul service with an identity, the hook fetches the signed service workload identity via widmgr.Get; failures are appended to the multierror as 'error getting signed identity for service %s'. The signed identity (JWT) is a prerequisite for the Consul JWT login, so this means Nomad could not provide a valid signed identity for the service.

Source

Thrown at client/allocrunner/consul_hook.go:216

			continue
		}

		clusterName := service.GetConsulClusterName(tg)
		consulConfig, ok := h.consulConfigs[clusterName]
		if !ok {
			return fmt.Errorf("no such consul cluster: %s", clusterName)
		}

		// Find signed identity workload.
		ti := *service.IdentityHandle(env.ReplaceEnv)
		tokenName := service.Identity.Name
		token := tokens[clusterName][tokenName]

		// If no token was previously stored, create one.
		if token == nil {
			swi, err := h.widmgr.Get(ti)
			if err != nil {
				mErr = multierror.Append(mErr, fmt.Errorf(
					"error getting signed identity for service %s: %v",
					service.Name, err,
				))
				continue
			}

			h.logger.Debug("logging into consul", "name", ti.IdentityName, "type", ti.WorkloadType)
			req := consul.JWTLoginRequest{
				JWT:            swi.JWT,
				AuthMethodName: consulConfig.ServiceIdentityAuthMethod,
				Meta: map[string]string{
					"requested_by": fmt.Sprintf("nomad_service_%s", ti.InterpolatedWorkloadIdentifier),
					"node_id":      h.alloc.NodeID,
				},
			}

			token, err = h.getConsulToken(clusterName, req)
			if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the underlying error in the agent log (multierror accumulates per-service failures)
2. Verify Nomad servers are healthy and workload-identity signing works (check server logs)
3. Stop and reschedule the allocation (nomad allocation stop) to force a fresh identity sign
4. Confirm the service block still declares a matching identity in the submitted job

// ensure the service declares a consul identity before prerun
if svc.IsConsul() && svc.Identity != nil {
    if _, err := widmgr.Get(*svc.IdentityHandle(env)); err != nil {
        return fmt.Errorf("signed identity for %s not ready: %w", svc.Name, err)
    }
}

if err := hook.Prerun(); err != nil {
    if mErr, ok := err.(*multierror.Error); ok {
        for _, e := range mErr.Errors {
            if strings.Contains(e.Error(), "error getting signed identity for service") {
                // retry after short delay; identity may still be propagating
            }
        }
    }
}

When it happens

Trigger: widmgr.Get fails for the service identity handle: signed identity not yet distributed, revoked, client state missing the entry, or identity signing failing on the server.

Common situations: Identity signing disabled or failing on Nomad servers; alloc restarted with stale hook state; service identity deleted from the job but the client still requests it; server connectivity issues preventing identity rotation.

Related errors

• error getting signed identity for task %s: %v
• no signed workload identity available
• failed to query Consul services: %w
• allocation does not exist
• Service %s in %s cannot have an identity until all servers a

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/ca2bafc690c9f039. Report an issue: GitHub.