hashicorp/nomad · error

failed to sign node identity claims: %v

Error message

failed to sign node identity claims: %v

What it means

When a registering node should receive fresh identity JWT claims, the server signs them via SignClaims. If signing fails (e.g., no keyring/key available), Register returns 'failed to sign node identity claims'. This is a server-side signing/keyring failure.

Source

Thrown at nomad/node_endpoint.go:253

		if err != nil {
			return fmt.Errorf("failed to query node pool: %v", err)
		}
		if nodePool == nil {
			identityTTL = structs.DefaultNodePoolNodeIdentityTTL
		} else {
			identityTTL = nodePool.NodeIdentityTTL
		}

		// Check if we need to generate a node identity. This must happen before we
		// send the Raft message, as the signing key ID is set on the node if we
		// generate one.
		if args.ShouldGenerateNodeIdentity(authErr, timeNow.UTC(), identityTTL) {

			claims := structs.GenerateNodeIdentityClaims(args.Node, n.srv.Region(), identityTTL)

			signedJWT, signingKeyID, err := n.srv.encrypter.SignClaims(claims)
			if err != nil {
				return fmt.Errorf("failed to sign node identity claims: %v", err)
			}

			reply.SignedIdentity = &signedJWT
			args.Node.IdentitySigningKeyID = signingKeyID
		} else if originalNode != nil {
			args.Node.IdentitySigningKeyID = originalNode.IdentitySigningKeyID
		}
	}

	_, index, err := n.srv.raftApply(structs.NodeRegisterRequestType, args)
	if err != nil {
		n.logger.Error("register failed", "error", err)
		return err
	}
	reply.NodeModifyIndex = index

	// Check if we should trigger evaluations
	if shouldCreateNodeEval(originalNode, args.Node) {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check server logs for encrypter/keyring errors and ensure the signing key exists in raft
2. Verify all servers are upgraded past the minimum version supporting node identities
3. Rotate or re-bootstrap the signing key per Nomad keyring docs
4. Retry registration after the cluster keyring is healthy

err := client.Nodes().Register(node, nil)
if err != nil && strings.Contains(err.Error(), "failed to sign node identity claims") {
    // keyring issue: do not hammer; investigate server keyring then retry
}

When it happens

Trigger: Node.Register with ShouldGenerateNodeIdentity true (auth error path or TTL expiry) while srv.encrypter.SignClaims errors — missing signing key, uninitialized keyring, or key metadata problems after key rotation/restore.

Common situations: Restored servers missing the keyring in raft; key rotation removed the active key; mixed-version cluster where encrypter state is unavailable; fresh cluster where keyring bootstrap failed.

Related errors

• failed to sign node introduction identity claims: %w
• node identity claims missing node pool
• no signed workload identity available
• node does not have a JWT identity token
• no auth method config or client assertion

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b8fc3f925b375066. Report an issue: GitHub.