hashicorp/nomad · error

%s provider cannot use the env block

Error message

%s provider cannot use the env block

What it means

Secret block validation error: the built-in "nomad" or "vault" provider is used together with an env block. Built-in providers deliver secrets via templates, not the env mapping reserved for custom plugins.

Source

Thrown at nomad/structs/structs.go:10648

	if s.Name == "" {
		_ = multierror.Append(&mErr, errors.New("secret name cannot be empty"))
	}

	if !validSecretName.MatchString(s.Name) {
		_ = multierror.Append(&mErr, fmt.Errorf("secret name must match regex %s", validSecretName))
	}

	if s.Provider == "" {
		_ = multierror.Append(&mErr, errors.New("secret provider cannot be empty"))
	}

	if s.Path == "" {
		_ = multierror.Append(&mErr, errors.New("secret path cannot be empty"))
	}

	if s.Provider == "nomad" || s.Provider == "vault" {
		if len(s.Env) > 0 {
			_ = multierror.Append(&mErr, fmt.Errorf("%s provider cannot use the env block", s.Provider))
		}
	} else {
		if len(s.Config) > 0 {
			_ = multierror.Append(&mErr, fmt.Errorf("custom plugin provider %s cannot use the config block", s.Provider))
		}
	}

	return mErr.ErrorOrNil()
}

func (s *Secret) Canonicalize() {
	if s == nil {
		return
	}

	if len(s.Config) == 0 {
		s.Config = nil
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the env block when using the nomad or vault provider
2. Use a custom plugin provider if env-based secret injection is required

When it happens

Trigger: Thrown at nomad/structs/structs.go:10648 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/623ed0dcdecb5cac. Report an issue: GitHub.