hashicorp/nomad · error

ttl for default identity not yet supported

Error message

ttl for default identity not yet supported

What it means

WorkloadIdentity.Validate rejects a positive TTL on the default identity (name empty or "default"). Nomad does not yet support expiring tokens for the default workload identity, so such a configuration is invalid. Only explicitly-named identities may carry a TTL.

Source

Thrown at nomad/structs/workload_id.go:486

	switch wi.ChangeMode {
	case "", WIChangeModeNoop, WIChangeModeRestart:
		// Treat "" as noop. Make sure signal isn't set.
		if wi.ChangeSignal != "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("can only use change_signal=%q with change_mode=%q",
				wi.ChangeSignal, WIChangeModeSignal))
		}
	case WIChangeModeSignal:
		if wi.ChangeSignal == "" {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("change_signal must be specified when using change_mode=%q", WIChangeModeSignal))
		}
	default:
		// Unknown change_mode
		mErr.Errors = append(mErr.Errors, fmt.Errorf("invalid change_mode: %s", wi.ChangeMode))
	}

	if wi.TTL > 0 && (wi.Name == "" || wi.Name == WorkloadIdentityDefaultName) {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("ttl for default identity not yet supported"))
	}

	if wi.TTL < 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("ttl must be >= 0"))
	}

	if wi.Filepath != "" && !wi.File {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("file parameter must be true in order to specify filepath"))
	}

	return mErr.ErrorOrNil()
}

func (wi *WorkloadIdentity) Warnings() error {
	if wi == nil {
		return fmt.Errorf("must not be nil")
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Give the identity an explicit non-default name (e.g. name = "aws") when setting ttl.
2. Remove the ttl from the default identity block until Nomad supports TTLs on the default identity.
3. Use a separate named identity block for the expiring credential instead of the default one.

Example fix

// before
identity {
  ttl = "1h"
}
// after
identity {
  name = "aws"
  ttl = "1h"
}

func validateTTLIdentity(wi *structs.WorkloadIdentity) error {
  if wi.TTL > 0 && (wi.Name == "" || wi.Name == structs.WorkloadIdentityDefaultName) {
    return fmt.Errorf("ttl requires a named (non-default) identity")
  }
  return nil
}

When it happens

Trigger: Defining an identity block with ttl > 0 while name is unset or equals "default", e.g. identity { ttl = "1h" } in a task's identity block, or structs.WorkloadIdentity{Name: "", TTL: duration} passed to Validate().

Common situations: Adding a TTL to the implicit default identity assuming it behaves like named identities; templating a job where the identity name is dropped/blank; copying a named-identity TTL config onto the default identity.

Related errors

• ttl must be >= 0
• default_identity_ttl must be greater than 0
• max_identity_ttl must be greater than 0
• max_identity_ttl must be greater than or equal to default_id
• TTL must be between 10 seconds and 24 hours

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/16956e83aa3a81f6. Report an issue: GitHub.