hashicorp/nomad · warning

using env=%t without change_mode=%q may result in task not g

Error message

using env=%t without change_mode=%q may result in task not getting updated identity

What it means

WorkloadIdentity.Warnings warns that an identity delivered via environment variables (env = true) with a change_mode other than "restart" may leave the task holding a stale identity: env vars are only re-read on restart, so signal/no-op rotation never refreshes them.

Source

Thrown at nomad/structs/workload_id.go:521

	}

	var mErr multierror.Error

	if n := len(wi.Audience); n == 0 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an audience are insecure"))
	} else if n > 1 {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("while multiple audiences is allowed, it is more secure to use 1 audience per identity"))
	}

	if wi.Name != "" && wi.Name != WorkloadIdentityDefaultName {
		if wi.TTL == 0 {
			mErr.Errors = append(mErr.Errors, fmt.Errorf("identities without an expiration are insecure"))
		}
	}

	// Warn users about using env vars without restarts
	if wi.Env && wi.ChangeMode != WIChangeModeRestart {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("using env=%t without change_mode=%q may result in task not getting updated identity",
			wi.Env, WIChangeModeRestart))
	}

	return mErr.ErrorOrNil()
}

// WorkloadIdentityRequest encapsulates the 3 parameters used to generated a
// signed workload identity: the alloc, task, and specific identity's name.
type WorkloadIdentityRequest struct {
	AllocID string
	WIHandle
}

// SignedWorkloadIdentity is the response to a WorkloadIdentityRequest and
// includes the JWT for the requested workload identity.
type SignedWorkloadIdentity struct {
	WorkloadIdentityRequest
	JWT        string

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set change_mode = "restart" so the task restarts and re-reads the updated env var.
2. Switch to file delivery (file = true, optionally filepath) which can be re-read in-process, keeping signal rotation.
3. Have the task re-exec or re-read its environment on the rotation signal if restarts are unacceptable.

Example fix

// before
identity {
  name = "aws"
  env = true
  change_mode = "signal"
  change_signal = "SIGHUP"
}
// after
identity {
  name = "aws"
  env = true
  change_mode = "restart"
}

func validateEnvDelivery(wi *structs.WorkloadIdentity) error {
  if wi.Env && wi.ChangeMode != structs.WIChangeModeRestart {
    return fmt.Errorf("env=true identities must use change_mode=%q to refresh env vars", structs.WIChangeModeRestart)
  }
  return nil
}

When it happens

Trigger: Calling Warnings() on an identity where wi.Env == true and wi.ChangeMode != WIChangeModeRestart, e.g. identity { env = true change_mode = "signal" change_signal = "SIGHUP" } or env = true with change_mode omitted-not-restart.

Common situations: Enabling env delivery while choosing signal rotation for smoother updates; copying a file-delivery identity config and flipping env = true without changing change_mode; template-generated jobs combining env=true with signal rotation.

Related errors

• no signed workload identity available
• error getting signed identity for task %s: %v
• error getting signed identity for service %s: %v
• failed to retrieve signed workload identity: %w
• no identities to sign

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0976c891648188b4. Report an issue: GitHub.