hashicorp/nomad · error

failed to load SI token for native task %s: %w

Error message

failed to load SI token for native task %s: %w

What it means

maybeSetSITokenEnv failed reading the Consul Service Identity token from secrets/si_token in the task workspace (file missing/unreadable) while setting CONSUL_HTTP_TOKEN for a Connect Native task, so the task cannot authenticate to Consul via the hook.

Source

Thrown at client/allocrunner/taskrunner/connect_native_hook.go:277

// directory AND the CONSUL_HTTP_TOKEN environment variable is not already set.
//
// Following the pattern of the envoy_bootstrap_hook, the Consul Service Identity
// ACL Token is generated prior to this hook, if Consul ACLs are enabled. This is
// done in the sids_hook, which places the token at secrets/si_token in the task
// workspace. The content of that file is the SI token specific to this task
// instance.
func (h *connectNativeHook) maybeSetSITokenEnv(dir, task string, env map[string]string) error {
	if _, exists := env["CONSUL_HTTP_TOKEN"]; exists {
		// Consul token was already set - typically by using the Vault integration
		// and a template block to set the environment. Ignore the SI token as
		// the configured token takes precedence.
		return nil
	}

	token, err := os.ReadFile(filepath.Join(dir, sidsTokenFile))
	if err != nil {
		if !os.IsNotExist(err) {
			return fmt.Errorf("failed to load SI token for native task %s: %w", task, err)
		}
		h.logger.Trace("no SI token to load for native task", "task", task)
		return nil // token file DNE; acls not enabled
	}
	h.logger.Trace("recovered pre-existing SI token for native task", "task", task)
	env["CONSUL_HTTP_TOKEN"] = string(token)
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify Consul ACLs are enabled consistently between server/client config
2. Check the sids_hook ran and wrote secrets/si_token before this hook
3. Confirm SI token generation succeeded in server logs
4. Set CONSUL_HTTP_TOKEN explicitly in the task env as a workaround

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/connect_native_hook.go:277 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c5a1222dce424f61. Report an issue: GitHub.