hashicorp/nomad · error

error getting signed identity for task %s: %v

Error message

error getting signed identity for task %s: %v

What it means

When no previously-derived token exists, prepareConsulTokensForTask fetches the task's signed workload identity (SPIFFE-style JWT) from the workload identity manager (widmgr). If widmgr.Get fails, the underlying error is wrapped as 'error getting signed identity for task %s'. This means Nomad could not obtain a valid signed identity for the task before logging into Consul.

Source

Thrown at client/allocrunner/consul_hook.go:164

	// Find task workload identity for Consul.
	widName := fmt.Sprintf("%s_%s", structs.ConsulTaskIdentityNamePrefix, consulConfig.Name)
	wid := task.GetIdentity(widName)
	if wid == nil {
		// Skip task if it doesn't have an identity for Consul since it doesn't
		// need a token.
		return nil
	}

	tokenName := widName + "/" + task.Name
	token := tokens[clusterName][tokenName]

	// If no token was previously stored, create one.
	if token == nil {
		// Find signed workload identity.
		ti := *task.IdentityHandle(wid)
		swi, err := h.widmgr.Get(ti)
		if err != nil {
			return fmt.Errorf("error getting signed identity for task %s: %v", task.Name, err)
		}

		h.logger.Debug("logging into consul", "name", ti.IdentityName, "type", ti.WorkloadType)
		req := consul.JWTLoginRequest{
			JWT:            swi.JWT,
			AuthMethodName: consulConfig.TaskIdentityAuthMethod,
			Meta: map[string]string{
				"requested_by": fmt.Sprintf("nomad_task_%s", task.Name),
				"node_id":      h.alloc.NodeID,
			},
		}

		token, err = h.getConsulToken(consulConfig.Name, req)
		if err != nil {
			return fmt.Errorf("failed to derive Consul token for task %s: %v", task.Name, err)
		}
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the wrapped underlying error in the agent log for the root cause (e.g. signing/ACL failure)
2. Ensure nomad server ACL and workload-identity signing are healthy and servers are reachable
3. Verify nomad client data dir permissions/state for the alloc; reschedule the allocation (nomad alloc stop) to force re-signing
4. Upgrade Nomad if hitting a known identity-propagation bug in your version

// before running tasks, confirm the signed identity is retrievable
if _, err := widmgr.Get(*task.IdentityHandle(wid)); err != nil {
    return fmt.Errorf("signed identity not ready: %w", err)
}

if err := hook.Prerun(); err != nil {
    if strings.Contains(err.Error(), "error getting signed identity") {
        // back off briefly and retry Prerun; identity signing may be pending
        time.Sleep(2 * time.Second)
        err = hook.Prerun()
    }
}

When it happens

Trigger: widmgr.Get returns an error, typically because the signed identity has not been delivered/rotated yet by the server, the identity was revoked, or client state storage for the alloc is unreadable.

Common situations: Server/identity signing issues (Nomad ACLs or workload identity signing disabled or failing); alloc restored from stale client state referencing a missing identity; timing issue where the task runs before the signed identity is distributed.

Related errors

• error getting signed identity for service %s: %v
• no signed workload identity available
• failed to sign node introduction identity claims: %w
• allocation does not exist
• Service %s in %s cannot have an identity until all servers a

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c1352d913d6980a9. Report an issue: GitHub.