What causes "No client configuration found for Vault cluster %s" in hashicorp/nomad?

Add the missing vault cluster stanza to the client agent config where the alloc runs

No client configuration found for Vault cluster %s

Error message

No client configuration found for Vault cluster %s

What it means

The vault hook, during Prestart, resolves the task's Vault cluster name and looks it up in the client's Vault configs (h.vaultConfigsFunc). Unlike newManager, this check runs after creating the Vault client; if no config block exists for the cluster, the hook cannot obtain connection details and Prestart fails.

Source

Thrown at client/allocrunner/taskrunner/vault_hook.go:168

func (h *vaultHook) Prestart(ctx context.Context, req *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
	// If we have already run prestart before exit early. We do not use the
	// PrestartDone value because we want to recover the token on restoration.
	first := h.firstRun
	h.firstRun = false
	if !first {
		return nil
	}

	cluster := h.task.GetVaultClusterName()
	vclient, err := h.clientFunc(cluster)
	if err != nil {
		return err
	}
	h.client = vclient

	h.vaultConfig = h.vaultConfigsFunc(h.logger)[cluster]
	if h.vaultConfig == nil {
		return fmt.Errorf("No client configuration found for Vault cluster %s", cluster)
	}

	// Try to recover a token if it was previously written in the secrets
	// directory
	token := ""
	h.privateDirTokenPath = filepath.Join(req.TaskDir.PrivateDir, vaultTokenFile)
	h.secretsDirTokenPath = filepath.Join(req.TaskDir.SecretsDir, vaultTokenFile)

	// Handle upgrade path by searching for the previous token in all possible
	// paths where the token may be.
	for _, path := range []string{h.privateDirTokenPath, h.secretsDirTokenPath} {
		data, err := os.ReadFile(path)
		if err != nil {
			if !os.IsNotExist(err) {
				return fmt.Errorf("failed to recover vault token from %s: %v", path, err)
			}

			// Token file doesn't exist in this path.

View on GitHub (pinned to 482b49bf1a)

Solutions

Add the missing vault cluster stanza to the client agent config where the alloc runs
Correct the task's vault cluster name to one configured on that client
Constrain the job's datacenter/region to nodes that have the cluster configured
Restart the nomad client after config changes

Defensive patterns

Strategy: validation

Validate before calling

# before scheduling, confirm the cluster exists on target clients
grep -A5 'cluster "my-vault"' /etc/nomad.d/client.hcl
# or once the agent is up:
# curl -s localhost:4646/v1/agent/self | jq .config.VaultConfigs

Try / catch

cfg := vaultConfigsFunc(logger)[cluster]
if cfg == nil {
    return fmt.Errorf("no vault config for cluster %q on this client; add vault.cluster %q stanza or fix the job", cluster, cluster)
}

Prevention

Standardize vault cluster names between client configs and job specs
Pin jobs to node pools/datacenters that have the referenced vault cluster configured
After renaming clusters in client config, redeploy affected jobs
Check agent logs at startup for vault config parse errors

When it happens

Trigger: A task with a vault block points to a cluster absent from the client agent's vault configuration; vaultConfigsFunc returns a map without that key so h.vaultConfig is nil.

Common situations: Renaming vault clusters in client config without redeploying jobs; the job targeting a cluster only configured on some client nodes (the alloc landed on a node lacking it); vault config typo.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/ade60f4b44f2c0a2. Report an issue: GitHub.