What causes "max_identity_ttl must be greater than 0" in hashicorp/nomad?

Set max_identity_ttl to a positive duration in the config (e.g. max_identity_ttl = "12h").

max_identity_ttl must be greater than 0

Error message

max_identity_ttl must be greater than 0

What it means

Config validation appends this error to a multierror when MaxIdentityTTL is less than 1 (zero or negative). The maximum workload identity token TTL must be a positive duration for the server to issue or bound identity tokens. It is returned as part of the aggregate error from Start/monitor paths.

Source

Thrown at nomad/structs/node.go:939

		return fmt.Errorf("cannot be empty")
	}

	var mErr *multierror.Error

	switch n.Enforcement {
	case NodeIntroductionEnforcementNone,
		NodeIntroductionEnforcementWarn,
		NodeIntroductionEnforcementStrict:
	default:
		mErr = multierror.Append(mErr, fmt.Errorf("invalid enforcement %q", n.Enforcement))
	}

	if n.DefaultIdentityTTL < 1 {
		mErr = multierror.Append(mErr, errors.New("default_identity_ttl must be greater than 0"))
	}

	if n.MaxIdentityTTL < 1 {
		mErr = multierror.Append(mErr, errors.New("max_identity_ttl must be greater than 0"))
	}

	if n.MaxIdentityTTL < n.DefaultIdentityTTL {
		mErr = multierror.Append(mErr, errors.New(
			"max_identity_ttl must be greater than or equal to default_identity_ttl",
		))
	}

	return mErr.ErrorOrNil()
}

// NodeIntroductionIdentityClaims contains the claims for node introduction.
type NodeIntroductionIdentityClaims struct {
	NodePool string `json:"nomad_node_pool"`
	NodeName string `json:"nomad_node_name"`
}

// GenerateNodeIntroductionIdentityClaims generates a new identity JWT for node

View on GitHub (pinned to 482b49bf1a)

Solutions

Set max_identity_ttl to a positive duration in the config (e.g. max_identity_ttl = "12h").
Also verify default_identity_ttl is set — both are required and validated together.
Fix any duration parsing/template rendering that silently produces 0, then restart the agent.

Example fix

# before
node {
  default_identity_ttl = "1h"
}
# after
node {
  default_identity_ttl = "1h"
  max_identity_ttl = "12h"
}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.MaxIdentityTTL < 1 {
	return fmt.Errorf("max_identity_ttl must be set to a positive duration, got %d", cfg.MaxIdentityTTL)
}

Try / catch

if err := ll.Start(ctx, fns...); err != nil {
	if strings.Contains(err.Error(), "max_identity_ttl must be greater than 0") {
		return fmt.Errorf("fix max identity TTL config: %w", err)
	}
	return err
}

Prevention

Set max_identity_ttl explicitly; never rely on zero values.
Validate all TTL fields together in one pre-flight check.
Guard duration parsing against empty/malformed inputs that coerce to 0.

When it happens

Trigger: Setting `max_identity_ttl` to 0 or negative in agent/node configuration and then starting the agent or invoking code that validates the config, producing the aggregated multierror containing this message.

Common situations: Omitted max_identity_ttl option defaulting to the zero value; duration parsing errors (empty or malformed string becoming 0); copied config snippets where the max line was commented out while default_identity_ttl remained.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4a89dbb3b15e7400. Report an issue: GitHub.