hashicorp/nomad · error

must not be nil

Error message

must not be nil

What it means

WorkloadIdentity.Validate guards against being called on a nil *WorkloadIdentity and returns this plain error if so. Since the method has a pointer receiver and tolerates nil, callers can invoke it on a nil value, and Nomad surfaces this as a validation failure rather than panicking.

Source

Thrown at nomad/structs/workload_id.go:453

	}

	if wi.Name == "" {
		wi.Name = WorkloadIdentityDefaultName
	}

	// The default identity is only valid for use with Nomad itself.
	if wi.Name == WorkloadIdentityDefaultName {
		wi.Audience = []string{IdentityDefaultAud}
	}

	if wi.ChangeSignal != "" {
		wi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)
	}
}

func (wi *WorkloadIdentity) Validate() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

	var mErr multierror.Error

	if !validIdentityName.MatchString(wi.Name) {
		err := fmt.Errorf("invalid name %q. Must match regex %s", wi.Name, validIdentityName)
		mErr.Errors = append(mErr.Errors, err)
	}

	for i, aud := range wi.Audience {
		if aud == "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("an empty string is an invalid audience (%d)", i+1))
		}
	}

	switch wi.ChangeMode {
	case "", WIChangeModeNoop, WIChangeModeRestart:
		// Treat "" as noop. Make sure signal isn't set.

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Ensure the WorkloadIdentity is constructed and assigned before validation.
2. Check upstream logic that populates identities so nil pointers are skipped or defaulted.
3. If nil is expected, guard the call site before invoking Validate.

Example fix

// before
err := wi.Validate() // wi may be nil
// after
if wi != nil {
    err = wi.Validate()
}

if wi == nil {
    return errors.New("workload identity not defined")
}
return wi.Validate()

func hasIdentity(wi *structs.WorkloadIdentity) bool {
    return wi != nil
}

if err := wi.Validate(); err != nil && err.Error() == "must not be nil" {
    // skip or construct a default identity
}

When it happens

Trigger: Calling wi.Validate() when wi is nil — e.g. a task block without a workload identity resolving to a nil pointer that is still validated, as exercised by TestWorkloadIdentity_Nil.

Common situations: Code that iterates over an identity map/slice containing nil entries; job parsing producing no WorkloadIdentity but downstream validation still running; misbuilt structs where the identity pointer was never assigned.

Related errors

• validate called on nil host volume capability
• missing node for client registration
• no identities to sign
• no identities requested
• Service identity must provide at least one target aud value

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/10ce0d07fe94614c. Report an issue: GitHub.