hashicorp/nomad · warning

Task %s has an identity called %s but no vault block

Error message

Task %s has an identity called %s but no vault block

What it means

Tasks not using Vault (no vault block) should not carry Vault workload identities. This is a warning (not an error) emitted when a task has an identity whose name starts with the Vault WID prefix (vault_) but no vault stanza, suggesting leftover config.

Source

Thrown at nomad/job_endpoint_hooks.go:589

		return fmt.Errorf("Service %s in %s has an identity with an empty name", s.Name, parent)
	}

	return nil
}

// validateVaultIdentity validates that a task is properly configured to access
// a Vault cluster.
//
// It assumes the jobImplicitIdentitiesHook mutator hook has been called to
// inject task identities if necessary.
func (v *jobValidate) validateVaultIdentity(t *structs.Task, okForIdentity bool) ([]error, error) {
	var warnings []error

	if t.Vault == nil {
		// Warn if task doesn't use Vault but has Vault identities.
		for _, wid := range t.Identities {
			if strings.HasPrefix(wid.Name, structs.WorkloadIdentityVaultPrefix) {
				warnings = append(warnings, fmt.Errorf("Task %s has an identity called %s but no vault block", t.Name, wid.Name))
			}
		}
		return warnings, nil
	}

	vaultWIDName := t.Vault.IdentityName()
	vaultWID := t.GetIdentity(vaultWIDName)

	if vaultWID != nil && !okForIdentity {
		return warnings, fmt.Errorf("Task %s cannot have an identity for Vault until all servers are upgraded to %s or later", t.Name, minVersionMultiIdentities)
	}

	if vaultWID == nil {
		// Tasks using non-default clusters are required to have an identity.
		if t.Vault.Cluster != structs.VaultDefaultCluster {
			return warnings, fmt.Errorf(
				"Task %s uses Vault cluster %s but does not have an identity named %s and no default identity is provided in agent configuration",
				t.Name, t.Vault.Cluster, vaultWIDName,

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Delete the unused vault_-prefixed identity from the task's identities list
2. Re-add the vault block if Vault access is actually intended
3. Rename the identity if it is non-Vault but accidentally named with the vault_ prefix

Example fix

// before
task "app" { identities = [{ name = "vault_default" }] }  # no vault block
// after
task "app" { identities = [] }  # or restore vault {} block

if task.Vault == nil {
	for _, id := range task.Identities {
		if strings.HasPrefix(id.Name, "vault_") {
			fmt.Printf("warning: task %s has vault identity %s without vault block\n", task.Name, id.Name)
		}
	}
}

func hasOrphanVaultIdentity(t *api.Task) bool {
	return t.Vault == nil && slices.ContainsFunc(t.Identities,
		func(w *api.WorkloadIdentity) bool { return strings.HasPrefix(w.Name, "vault_") })
}

When it happens

Trigger: Validating a job where t.Vault is nil but one of the task's identities has a name prefixed with structs.WorkloadIdentityVaultPrefix ("vault_").

Common situations: Removing the vault block but forgetting to drop the matching identity; copy-pasting identity blocks from other tasks; renames leaving stale vault_ identities.

Related errors

• no signed workload identity available
• failed to retrieve signed workload identity: %w
• %w, Namespaces: %s
• Service %s in %s has an identity with an empty name
• Task %s cannot have an identity for Vault until all servers

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a7ebe558ecc86f5b. Report an issue: GitHub.