hashicorp/nomad · error

no identities requested

Error message

no identities requested

What it means

SignIdentities signs workload identity JWTs for allocations, but a request with an empty Identities slice is a client bug and a wasted no-op, so the server fails loudly with 'no identities requested' rather than returning an empty result after a potentially blocking query.

Source

Thrown at nomad/alloc_endpoint.go:470

// allocations.
//
// This is an internal-only RPC and not exposed via the HTTP API.
func (a *Alloc) SignIdentities(args *structs.AllocIdentitiesRequest, reply *structs.AllocIdentitiesResponse) error {

	aclObj, err := a.srv.AuthenticateClientOnly(a.ctx, args)
	if done, err := a.srv.forward("Alloc.SignIdentities", args, args, reply); done {
		return err
	}
	a.srv.MeasureRPCRate("alloc", structs.RateMetricRead, args)
	if err != nil {
		return structs.ErrPermissionDenied
	}
	defer metrics.MeasureSince([]string{"nomad", "alloc", "sign_identities"}, time.Now())

	if len(args.Identities) == 0 {
		// Client bug. Fail loudly instead of letting clients waste time with
		// noops.
		return fmt.Errorf("no identities requested")
	}

	// Tracks whether the min index was satisfied by the blocking query
	thresholdMet := false

	// Most if not all identity requests will be for the same alloc, so create a
	// set of alloc IDs to avoid unnecessary looping in the blocking query.
	allocs := make(map[string]*structs.Allocation, len(args.Identities))
	for _, idReq := range args.Identities {
		allocs[idReq.AllocID] = nil // to be set while watching
	}

	opts := blockingOptions{
		queryOpts: &args.QueryOptions,
		queryMeta: &reply.QueryMeta,
		run: func(ws memdb.WatchSet, state *state.StateStore) error {
			var maxIndex uint64

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Ensure the caller populates args.Identities with the workload identity requests before invoking the RPC
2. Skip the call when there are no identities to sign (no identities configured on the task group)
3. Upgrade the Nomad client — this is flagged as a client bug, so check for fixed versions

Example fix

// before
client.SignIdentities(args) // Identities: [] — noop
// after
if len(args.Identities) == 0 {
    return nil // nothing to sign
}
client.SignIdentities(args)

if len(req.Identities) == 0 {
    return nil // nothing to sign; avoid the RPC
}

if err != nil && strings.Contains(err.Error(), "no identities requested") {
    // client bug: log and skip; do not retry identical request
    return nil
}

When it happens

Trigger: Calling the Alloc.SignIdentities RPC with args.Identities empty — a Nomad client compiled/misbehaving such that it sends zero identity requests, or custom tooling invoking the RPC directly with an empty list.

Common situations: Nomad client version mismatch with servers; a client bug when an alloc has no workload identities configured; scripts calling the internal RPC without populating Identities.

Related errors

• Must provide the NodeID
• Parameter for choose must be in form '<number>|<key>'
• missing node for client registration
• missing node ID for client registration
• missing datacenter for client registration

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c99315d60421c2bb. Report an issue: GitHub.