What causes "failed to sign node introduction identity claims: %w" in hashicorp/nomad?

Inspect the wrapped cause (`%w`) in Nomad server logs to identify the keyring error

failed to sign node introduction identity claims: %w

Error message

failed to sign node introduction identity claims: %w

What it means

CreateClientIntroductionToken builds node introduction identity claims and signs them with the server's keyring via encrypter.SignClaims. If the signing operation fails, the underlying error is wrapped as 'failed to sign node introduction identity claims'. Signing depends on the server holding a valid encryption key, so this indicates a server-side keyring/cryptography problem.

Source

Thrown at nomad/acl_endpoint.go:3244

	// Generate the node introduction identity TTL based on the server config
	// and any possible user provided TTL.
	identityTTL := args.IdentityTTL(
		a.logger,
		a.srv.config.NodeIntroductionConfig.DefaultIdentityTTL,
		a.srv.config.NodeIntroductionConfig.MaxIdentityTTL,
	)

	introIdentity := structs.GenerateNodeIntroductionIdentityClaims(
		args.NodeName,
		args.NodePool,
		args.Region,
		identityTTL,
	)

	signedIdentity, _, err := a.srv.encrypter.SignClaims(introIdentity)
	if err != nil {
		return fmt.Errorf("failed to sign node introduction identity claims: %w", err)
	}

	reply.JWT = signedIdentity
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Inspect the wrapped cause (`%w`) in Nomad server logs to identify the keyring error
Verify the server keyring is initialized: check the keystore files under the server's data dir
Ensure the key used for signing was rotated/replicated to all servers (`nomad keyring` operations) and retry
Restart the server so the keyring is reloaded; restore keys from backup if missing

Defensive patterns

Strategy: retry

Try / catch

if strings.Contains(err.Error(), "failed to sign node introduction identity claims") {
    // inspect wrapped cause; retry after keyring health is confirmed
    log.Printf("signing failure: %v", err)
}

Prevention

Keep server keystore files backed up and consistent across servers
Test key rotation in staging and verify signing works afterwards
Alert on keyring initialization errors at server startup

When it happens

Trigger: Calling CreateClientIntroductionToken when SignClaims returns an error — e.g. the server's keyring is uninitialized or the signing key is missing/corrupt, or identity claim serialization fails.

Common situations: Restored server from backup without the keyring; key rotation left the server without the needed key; corrupted state store/keystore on disk; signing key not yet replicated to a new server.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c175f5f156eae210. Report an issue: GitHub.