hashicorp/nomad · error

unexpected ClockSkewLeeway type: %v

Error message

unexpected ClockSkewLeeway type: %v

What it means

Returned by ACLAuthMethod's ClockSkewLeeway unmarshaling/validation when the JSON/HCL value for `ClockSkewLeeway` is neither a string (duration) nor a float64. The field is decoded in a type-switch, and any other Go type (e.g. bool, map, nested object) reaches the default branch. It indicates a malformed duration value in the auth method configuration.

Source

Thrown at nomad/structs/acl.go:1706

			}
		case float64:
			a.NotBeforeLeeway = time.Duration(v)
		default:
			return fmt.Errorf("unexpected NotBeforeLeeway type: %v", v)
		}
	}
	if aux.ClockSkewLeeway != nil {
		switch v := aux.ClockSkewLeeway.(type) {
		case string:
			if v != "" {
				if a.ClockSkewLeeway, err = time.ParseDuration(v); err != nil {
					return err
				}
			}
		case float64:
			a.ClockSkewLeeway = time.Duration(v)
		default:
			return fmt.Errorf("unexpected ClockSkewLeeway type: %v", v)
		}
	}
	return nil
}

type OIDCClientAssertionKeySource string

const (
	OIDCKeySourceNomad        OIDCClientAssertionKeySource = "nomad"
	OIDCKeySourceClientSecret OIDCClientAssertionKeySource = "client_secret"
	OIDCKeySourcePrivateKey   OIDCClientAssertionKeySource = "private_key"
)

// OIDCClientAssertion (a.k.a private_key_jwt) is used to send
// a client_assertion along with an OIDC token request.
// See api.OIDCClientAssertion for full field descriptions.
type OIDCClientAssertion struct {
	KeySource    OIDCClientAssertionKeySource

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set ClockSkewLeeway to a duration string, e.g. "5m" or "300s".
2. In JSON, ensure the value is a quoted string (or plain number of nanoseconds) - not a bool/object.
3. Re-run the auth-method create/update after fixing the config.

Example fix

// before
clock_skew_leeway = true

// after
clock_skew_leeway = "5m"

v, ok := rawClockSkewLeeway.(string)
if !ok {
    if _, isNum := rawClockSkewLeeway.(float64); !isNum {
        return fmt.Errorf("clock_skew_leeway must be a duration string, got %T", rawClockSkewLeeway)
    }
}
if _, err := time.ParseDuration(v); err != nil {
    return fmt.Errorf("clock_skew_leeway invalid duration: %w", err)
}

func isClockSkewLeewayValue(v interface{}) bool {
    switch v.(type) {
    case string, float64:
        return true
    default:
        return false
    }
}

When it happens

Trigger: Submitting an ACL auth method (ACLAuthMethodUpsertRequest or nomad acl auth-method create/update) where ClockSkewLeeway is given a value that decodes to a type other than string or float64 - e.g. a YAML/HCL bool, list, or nested map instead of a duration string like "5m".

Common situations: HCL config with `clock_skew_leeway = true` or an unquoted bare word; JSON job/config where the duration was accidentally left as an object; tooling emitting wrong JSON types; copy-paste of a struct literal instead of a duration string.

Related errors

• Job registration, dispatch, and scale are disabled by the sc
• ACL auth method lookup failed: %v
• ACL binding rule insert failed: ACL auth method not found
• default ACL auth method already exists: %v
• unexpected TTL type: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/bd9d608299aafefd. Report an issue: GitHub.