What causes "[✘] Role could not be interpolated with args: %w" in hashicorp/nomad?

Inspect the role map before marshaling and remove/convert unsupported value types

[✘] Role could not be interpolated with args: %w

Error message

[✘] Role could not be interpolated with args: %w

What it means

createRole in the Vault setup command marshals the role definition map to JSON before writing it to Vault's JWT auth role endpoint. This error wraps any json.Marshal failure, meaning the role map contains values that Go cannot serialize (e.g. channels, funcs, or unsupported types injected at runtime).

Source

Thrown at command/setup_vault.go:444

	return false
}

func (s *SetupVaultCommand) renderRole() (map[string]any, error) {
	role := map[string]any{}
	err := json.Unmarshal(vaultRoleBody, &role)
	if err != nil {
		return role, fmt.Errorf("[✘] Role data could not be deserialized: %w", err)
	}

	role["bound_audiences"] = vaultAud

	return role, nil
}

func (s *SetupVaultCommand) createRole(role map[string]any) error {
	buf, err := json.Marshal(role)
	if err != nil {
		return fmt.Errorf("[✘] Role could not be interpolated with args: %w", err)
	}

	path := fmt.Sprintf("auth/%s/role/%s", vaultPath, vaultRole)

	_, err = s.vLogical.WriteBytes(path, buf)
	if err != nil {
		return fmt.Errorf("[✘] Could not create Vault role: %w", err)
	}

	s.Ui.Info(fmt.Sprintf("[✔] Created role %q.", vaultRole))
	return nil
}

func (s *SetupVaultCommand) policyExists() bool {
	existingPolicies, _ := s.vClient.Sys().ListPolicies()
	return slices.Contains(existingPolicies, vaultPolicyName)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Inspect the role map before marshaling and remove/convert unsupported value types
Ensure role values are only strings, bools, numbers, slices, and maps
Rebuild nomad-setup without local patches that alter the role map

Defensive patterns

Strategy: validation

Validate before calling

buf, err := json.Marshal(role)
if err != nil {
    return fmt.Errorf("role config not JSON-serializable: %w", err)
}

Try / catch

if _, err := json.Marshal(role); err != nil { /* inspect unsupported types */ }

Prevention

Only populate role maps with strings, bools, numbers, slices, maps
Never inject chan/func values into config maps
Add a unit test that marshals the default role map

When it happens

Trigger: json.Marshal(role) fails because the role map passed from Run contains a value of a non-JSON-serializable type (chan, func, complex) or an invalid UTF-8 structure.

Common situations: Programmatic customization of the role map (via custom code or a patched binary) inserting unsupported types; normally never triggered by CLI flags since flags produce strings/bools.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5da3039ba21de44f. Report an issue: GitHub.