hashicorp/nomad · error

missing secret ID

Error message

missing secret ID

What it means

The Create endpoint (CSI volume create/`nomad volume create`) requires at least one volume definition in the request's Volumes list. An empty request is rejected before any validation or plugin RPC occurs.

Source

Thrown at api/acl.go:150

	if token.AccessorID != "" {
		return nil, nil, errors.New("cannot specify Accessor ID")
	}
	var resp ACLToken
	wm, err := a.client.put("/v1/acl/token", token, &resp, q)
	if err != nil {
		return nil, nil, err
	}
	return &resp, wm, nil
}

// Upload is used to create a client token with pre-specified AccessorID and
// SecretID. Management tokens cannot be uploaded and must be created with Create.
func (a *ACLTokens) Upload(token *ACLToken, q *WriteOptions) (*ACLToken, *WriteMeta, error) {
	if token.AccessorID == "" {
		return nil, nil, errors.New("missing accessor ID")
	}
	if token.SecretID == "" {
		return nil, nil, errors.New("missing secret ID")
	}
	if token.Type == "management" {
		return nil, nil, errors.New("cannot upload management tokens")
	}
	var resp ACLToken
	wm, err := a.client.put("/v1/acl/token/"+token.AccessorID, token, &resp, q)
	if err != nil {
		return nil, nil, err
	}
	return &resp, wm, nil
}

// Update is used to update an existing token
func (a *ACLTokens) Update(token *ACLToken, q *WriteOptions) (*ACLToken, *WriteMeta, error) {
	if token.AccessorID == "" {
		return nil, nil, errors.New("missing accessor ID")
	}
	var resp ACLToken

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Include at least one volume block in the request (nomad volume create file.hcl with a `volume` stanza)
2. Verify the HCL/JSON file actually contains volume definitions and parses correctly
3. Check templating output (consul-template/nomad var rendering) isn't dropping the volume blocks

Example fix

# before: file with no volume blocks
id   = "ebs-vol"
type = "csi"
# after
id   = "ebs-vol"
type = "csi"
volume {
  plugin_id      = "aws-ebs"
  capacity_min   = "10GiB"
  capacity_max   = "20GiB"
  capability { access_mode = "single-node-writer" attachment_mode = "file-system" }
}

// client-side check before calling Create
if len(request.Volumes) == 0 {
    return fmt.Errorf("at least one volume definition required")
}

if err := create(req); err != nil && strings.Contains(err.Error(), "missing volume definition") {
    // fix request payload: include >=1 volume block
}

When it happens

Trigger: Calling the Create RPC (POST /v1/volumes/create or SDK equivalent) with an empty or omitted Volumes array; templated HCL that rendered to zero volume blocks.

Common situations: HCL file with only `type = "csi"` but no volume stanza; variable interpolation producing empty list; scripting the HTTP API and forgetting the JSON body.

Related errors

• CSI.ControllerAttachVolume: VolumeID is required
• CSI.ControllerAttachVolume: ClientCSINodeID is required
• CSI.ControllerDetachVolume: VolumeID is required
• CSI.ControllerDetachVolume: ClientCSINodeID is required
• CSI.NodeDetachVolume: PluginID is required

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0fb34bc09f495cb6. Report an issue: GitHub.