non-default Vault cluster requires Nomad Enterprise

Error message

non-default Vault cluster requires Nomad Enterprise

What it means

CE build guard in jobVaultHook.validateClustersForNamespace: a job references a Vault cluster other than the default (multi-cluster/namespace Vault integration), which is Nomad Enterprise-only, so validation fails on the open-source edition.

Source

Thrown at nomad/job_endpoint_hook_vault_ce.go:30

	"github.com/hashicorp/nomad/nomad/structs"
)

// validateNamespaces returns an error if the job contains any Vault namespaces.
func (jobVaultHook) validateNamespaces(blocks map[string]map[string]*structs.Vault) error {

	requestedNamespaces := structs.VaultNamespaceSet(blocks)
	if len(requestedNamespaces) > 0 {
		return fmt.Errorf("%w, Namespaces: %s", ErrMultipleNamespaces, strings.Join(requestedNamespaces, ", "))
	}
	return nil
}

func (h jobVaultHook) validateClustersForNamespace(_ *structs.Job, blocks map[string]map[string]*structs.Vault) error {
	for _, tg := range blocks {
		for _, vault := range tg {
			if vault.Cluster != "default" {
				return errors.New("non-default Vault cluster requires Nomad Enterprise")
			}
		}
	}

	return nil
}

func (h jobVaultHook) Mutate(job *structs.Job) (*structs.Job, []error, error) {
	for _, tg := range job.TaskGroups {
		for _, task := range tg.Tasks {
			if task.Vault == nil || task.Vault.Cluster != "" {
				continue
			}
			task.Vault.Cluster = "default"
		}
	}

	return job, nil, nil

View on GitHub (pinned to 482b49bf1a)

Solutions

Remove the `cluster` field (or set it to "default") in the job's vault block.
Upgrade to Nomad Enterprise for multi-Vault-cluster support.
Configure the agent's single Vault cluster appropriately instead.

Example fix

// before
vault {
  cluster = "prod-vault"
  policies = ["app"]
}

// after
vault {
  policies = ["app"]
}

Defensive patterns

Strategy: validation

Validate before calling

if job.Vault != nil && job.Vault.Cluster != "" && job.Vault.Cluster != "default" {
  return errors.New("non-default Vault cluster requires Nomad Enterprise")
}

Prevention

Leave vault.cluster unset on OSS
Verify Vault cluster naming config against the server edition
Lint job files for enterprise-only fields before deploy

When it happens

Trigger: Setting `vault { cluster = "<name>" }` in a task/group/job on a Nomad OSS server and validating the job.

Common situations: Copying Enterprise multi-Vault-cluster job files to OSS; attempting to target a second Vault cluster without a license.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1925f3d99bc73348. Report an issue: GitHub.