hashicorp/nomad · error

Secret %q is invalid: %w

Error message

Secret %q is invalid: %w

What it means

Each task secret is validated by Secret.Validate; failures are wrapped as 'Secret %q is invalid: %w' in Task.Validate. The inner error describes the specific problem: empty name, invalid provider, missing/invalid path, or bad identity configuration for the provider.

Source

Thrown at nomad/structs/structs.go:8457

		if err := wid.Validate(); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Identity %q is invalid: %w", wid.Name, err))
		}
	}

	secrets := make(map[string]bool)
	for _, s := range t.Secrets {
		if _, ok := secrets[s.Name]; ok {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Duplicate secret %q found", s.Name))
		} else {
			secrets[s.Name] = true
		}

		if s.Provider == SecretProviderVault && t.Vault == nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Secret %q has provider \"vault\" but no vault block", s.Name))
		}

		if err := s.Validate(); err != nil {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("Secret %q is invalid: %w", s.Name, err))
		}
	}

	return mErr.ErrorOrNil()
}

// validateServices takes a task and validates the services within it are valid
// and reference ports that exist.
func validateServices(t *Task, tgNetworks Networks) error {
	var mErr multierror.Error

	// Ensure that services don't ask for nonexistent ports and their names are
	// unique.
	servicePorts := make(map[string]map[string]struct{})
	addServicePort := func(label, service string) {
		if _, ok := servicePorts[label]; !ok {
			servicePorts[label] = map[string]struct{}{}
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Read the wrapped inner error after 'is invalid:' to find the failing field
2. Ensure name and provider are set to valid values and path includes the secret key
3. Validate locally with `nomad job validate` and fix the offending block
4. Check provider docs (vault/nomad) for required fields

Example fix

// before
secrets {
  provider = "vault"
  path     = "kv/data/db"
}
// after
secrets {
  name     = "db_password"
  provider = "vault"
  path     = "kv/data/db#password"
}

for _, s := range t.Secrets {
    if err := s.Validate(); err != nil {
        return fmt.Errorf("secret %q bad: %w", s.Name, err)
    }
}

if err := job.Validate(); err != nil {
    // surface wrapped 'Secret %q is invalid:' causes to the user
}

When it happens

Trigger: secrets { } block with an empty name, unsupported provider string, malformed path (e.g. missing key), or a provider like "vault" whose required fields are absent; the wrapped %w carries the precise cause.

Common situations: Typos in provider name ("Vault", "nomad"); path missing the key segment ("kv/data/db" without key for KV v1); secrets defined via generated jobspec where fields were interpolated to empty strings.

Related errors

• namespace cannot contain template delimiters or parenthesis
• secret name cannot be empty
• secret provider cannot be empty
• secret path cannot be empty
• Duplicate secret %q found

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/774b9c85577004b3. Report an issue: GitHub.