hashicorp/nomad · error

Multi-Cluster Vault is unlicensed.

Error message

Multi-Cluster Vault is unlicensed.

What it means

NamespaceVaultConfiguration.Validate in the CE build rejects any non-nil multi-cluster Vault namespace configuration with "Multi-Cluster Vault is unlicensed." This feature (per-namespace Vault configuration allowing different Vault clusters/namespaces per Nomad namespace) is enterprise-only, so the OSS binary hard-fails whenever the block is present.

Source

Thrown at nomad/structs/structs_ce.go:30

	multierror "github.com/hashicorp/go-multierror"
)

func (n *Namespace) Canonicalize() {}

func (n *NamespaceNodePoolConfiguration) Canonicalize() {}

func (n *NamespaceNodePoolConfiguration) Validate() error {
	if n != nil {
		return errors.New("Node Pools Governance is unlicensed.")
	}
	return nil
}

func (n *NamespaceVaultConfiguration) Canonicalize() {}

func (n *NamespaceVaultConfiguration) Validate() error {
	if n != nil {
		return errors.New("Multi-Cluster Vault is unlicensed.")
	}
	return nil
}

func (n *NamespaceConsulConfiguration) Canonicalize() {}

func (n *NamespaceConsulConfiguration) Validate() error {
	if n != nil {
		return errors.New("Multi-Cluster Consul is unlicensed.")
	}
	return nil
}

func (m *Multiregion) Validate(jobType string, jobDatacenters []string) error {
	if m != nil {
		return errors.New("Multiregion jobs are unlicensed.")
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the vault configuration block from the namespace, keeping cluster-level Vault integration instead.
2. Switch to Nomad Enterprise with a license covering Multi-Cluster Vault.
3. Set the NamespaceVaultConfiguration field to nil in tooling that builds namespace payloads.

Example fix

// before
ns.VaultConfiguration = &structs.NamespaceVaultConfiguration{DefaultNamespace: "admin"}
// after
ns.VaultConfiguration = nil // Multi-Cluster Vault requires Enterprise license

if ns.VaultConfiguration != nil {
	return errors.New("multi-cluster vault requires Nomad Enterprise")
}

func vaultLicensed(cfg *structs.NamespaceVaultConfiguration) bool { return cfg == nil }

if err := ns.Validate(); err != nil && strings.Contains(err.Error(), "unlicensed") {
	ns.VaultConfiguration = nil // retry without the block
}

When it happens

Trigger: Creating or updating a namespace where NamespaceVaultConfiguration is non-nil (e.g. vault { cluster = "..." default_namespace = "..." } inside a namespace stanza) against a community-edition agent.

Common situations: Applying namespace specs dumped from an Enterprise cluster to OSS; enabling multi-cluster Vault docs examples without an Enterprise license; IaC modules that always render the vault block.

Related errors

• ErrMultipleNamespaces
• Feature "Node Pools Governance" is unlicensed
• Node Pools Governance is unlicensed.
• Multi-Cluster Consul is unlicensed.
• Multiregion jobs are unlicensed.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c0c734940370f34d. Report an issue: GitHub.