hashicorp/nomad · error

only one server.keyring can be active in Nomad Community Edi

Error message

only one server.keyring can be active in Nomad Community Edition

What it means

Nomad Community Edition permits only one active KEK provider in the server.keyring configuration. During NewEncrypter, getProviderConfigs counts active providers and aborts with this error when more than one is configured. Nomad Enterprise allows multiple; CE enforces the single-provider limit.

Source

Thrown at nomad/encrypter_ce.go:29

	"github.com/hashicorp/nomad/nomad/structs"
)

func getProviderConfigs(srv *Server) (map[string]*structs.KEKProviderConfig, error) {
	providerConfigs := map[string]*structs.KEKProviderConfig{}
	config := srv.GetConfig()
	var active int
	for _, provider := range config.KEKProviderConfigs {
		if provider.Active {
			active++
		}
		if provider.Provider == structs.KEKProviderVaultTransit {
			fallbackVaultConfig(provider, config.GetDefaultVault())
		}

		providerConfigs[provider.ID()] = provider
	}
	if active > 1 {
		return nil, fmt.Errorf(
			"only one server.keyring can be active in Nomad Community Edition")
	}

	if len(srv.config.KEKProviderConfigs) == 0 {
		providerConfigs[string(structs.KEKProviderAEAD)] = &structs.KEKProviderConfig{
			Provider: structs.KEKProviderAEAD,
			Active:   true,
		}
	}

	return providerConfigs, nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove or disable all but one server.keyring provider block in the config.
2. If multiple providers are required, use Nomad Enterprise.
3. Set 'active = false' on the extra provider blocks rather than deleting them, to retain their keys.
4. Restart the agent and confirm NewEncrypter succeeds.
5. Audit the config with `nomad agent -config ... -verify-only` before deploy to catch this early.

Example fix

// before (CE)
server {
  keyring {
    provider = "aead"  active = true
  }
  keyring {
    provider = "pkcs11" active = true  # second active provider
  }
}
// after
server {
  keyring { provider = "aead" active = true }
  keyring { provider = "pkcs11" active = false }
}

providers := cfg.Server.KEKProviderConfigs
active := 0
for _, p := range providers {
	if p.Active { active++ }
}
if active > 1 && isCommunityEdition {
	return fmt.Errorf("CE allows only one active server.keyring provider")
}

When it happens

Trigger: The server config defines more than one active keyring/KEK provider block (e.g. both an aead block and a pkcs11/vault block, or two named providers marked active) on a CE binary.

Common situations: Copy-pasting an Enterprise example config into CE; upgrading CE while leftover multiple provider blocks remain in the HCL/JSON config; operators enabling a second provider to 'pre-rotate' without realizing the CE restriction.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• dynamic workload users disabled
• Invalid key: %s
• failed to fetch key from any peer: %v
• failed to add key to keyring: %v
• timeout cannot be negative

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/50837ea333a8df52. Report an issue: GitHub.