hashicorp/nomad · error

failed to create secrets/%s: %w

Error message

failed to create secrets/%s: %w

What it means

copyCertificate failed creating the destination file under the task's secrets/ directory (os.Create error), typically due to directory permissions or a read-only filesystem, aborting TLS certificate setup for Connect Native tasks.

Source

Thrown at client/allocrunner/taskrunner/connect_native_hook.go:160

	}
	return nil
}

func (connectNativeHook) copyCertificate(source, dir, name string) error {
	if source == "" {
		return nil
	}

	original, err := os.Open(source)
	if err != nil {
		return fmt.Errorf("failed to open consul TLS certificate: %w", err)
	}
	defer original.Close()

	destination := filepath.Join(dir, name)
	fd, err := os.Create(destination)
	if err != nil {
		return fmt.Errorf("failed to create secrets/%s: %w", name, err)
	}
	defer fd.Close()

	if _, err := io.Copy(fd, original); err != nil {
		return fmt.Errorf("failed to copy certificate secrets/%s: %w", name, err)
	}

	if err := fd.Sync(); err != nil {
		return fmt.Errorf("failed to write secrets/%s: %w", name, err)
	}

	return nil
}

// tlsEnv creates a set of additional of environment variables to be used when launching
// the connect native task. This will enable the task to communicate with Consul
// if Consul has transport security turned on.
//

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check secrets dir permissions in the task's alloc dir
2. Verify the alloc dir filesystem is writable and not full
3. Restart the allocation to recreate the secrets directory

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/connect_native_hook.go:160 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0318bf6f5437c723. Report an issue: GitHub.