hashicorp/nomad · error

nil vault config

Error message

nil vault config

What it means

NewVaultClient requires a non-nil *config.VaultConfig; if nil it cannot construct the vaultClient (it immediately reads config.Name and other fields), so it returns this sentinel error. It is a programmer/config plumbing bug, not a runtime Vault failure.

Source

Thrown at client/vaultclient/vaultclient.go:78

	client *vaultapi.Client

	// updateCh is the channel to notify heap modifications to the renewal
	// loop
	updateCh chan struct{}

	// stopCh is the channel to trigger termination of renewal loop
	stopCh chan struct{}

	// config is the configuration to connect to vault
	config *config.VaultConfig

	logger hclog.Logger
}

// NewVaultClient returns a new vault client from the given config.
func NewVaultClient(config *config.VaultConfig, logger hclog.Logger) (*vaultClient, error) {
	if config == nil {
		return nil, fmt.Errorf("nil vault config")
	}

	logger = logger.Named("vault").With("name", config.Name)

	c := &vaultClient{
		config:   config,
		stopCh:   make(chan struct{}),
		updateCh: make(chan struct{}, 1), // Update channel should be buffered.
		logger:   logger,
	}

	if !config.IsEnabled() {
		return c, nil
	}

	// Get the Vault API configuration
	apiConf, err := config.ApiConfig()
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check config.VaultConfig != nil before calling NewVaultClient.
2. Ensure the Nomad config actually contains a vault stanza when Vault features are used.
3. In setup code, skip Vault client creation when Vault is not enabled instead of passing a nil config.
4. Initialize the VaultConfig through the official config loader rather than constructing it by hand.

Example fix

// before
vc, err := NewVaultClient(cfg.Vault, logger)
// after
if cfg.Vault == nil {
    return nil // vault not configured; skip
}
vc, err := NewVaultClient(cfg.Vault, logger)

if cfg == nil || cfg.Vault == nil {
    return fmt.Errorf("vault is not configured")
}
vc, err := NewVaultClient(cfg.Vault, logger)

When it happens

Trigger: Calling NewVaultClient(config, logger) with a nil VaultConfig — e.g. the config loader returned nil because Vault is not configured, or a caller passed a zero/missing pointer before the nil check.

Common situations: Nomad agent started without a vault stanza, config parsing skipped creating the VaultConfig, or test/setup code (setupVaultClients) invoking the constructor without guarding for unconfigured Vault.

Related errors

• failed to parse signal: %w
• no signed workload identity available
• plugin not found
• wait config is nil or empty
• wait config is empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/30091bf61f76fd4a. Report an issue: GitHub.