hashicorp/nomad · error

Vault cluster %q is disabled or not configured

Error message

Vault cluster %q is disabled or not configured

What it means

In newManager, the template hook checks that if the task declares a vault block, the Nomad client actually has a Vault configuration for the resolved vault cluster name. If task.Vault is set but clientConfig.GetVaultConfigs(...)[vaultCluster] is nil, template rendering cannot proceed and this error is thrown.

Source

Thrown at client/allocrunner/taskrunner/template_hook.go:206

	once, watch := []*structs.Template{}, []*structs.Template{}
	for _, tmpl := range h.config.templates {
		if tmpl.Once {
			once = append(once, tmpl)
		} else {
			watch = append(watch, tmpl)
		}
	}

	return h.renderTemplates(ctx, once, watch)
}

func (h *templateHook) newManager(tmpls []*structs.Template) (manager *template.TaskTemplateManager, unblock chan struct{}, err error) {
	vaultCluster := h.task.GetVaultClusterName()
	vaultConfig := h.config.clientConfig.GetVaultConfigs(h.logger)[vaultCluster]

	// Fail if task has a vault block but no client config was found.
	if h.task.Vault != nil && vaultConfig == nil {
		return nil, nil, fmt.Errorf("Vault cluster %q is disabled or not configured", vaultCluster)
	}

	tg := h.config.alloc.Job.LookupTaskGroup(h.config.alloc.TaskGroup)
	consulCluster := h.task.GetConsulClusterName(tg)
	consulConfig := h.config.clientConfig.GetConsulConfigs(h.logger)[consulCluster]

	unblock = make(chan struct{})
	m, err := template.NewTaskTemplateManager(&template.TaskTemplateManagerConfig{
		UnblockCh:            unblock,
		Lifecycle:            h.config.lifecycle,
		Events:               h.config.events,
		Templates:            tmpls,
		ClientConfig:         h.config.clientConfig,
		ConsulNamespace:      h.config.consulNamespace,
		ConsulToken:          h.consulToken,
		ConsulConfig:         consulConfig,
		VaultToken:           h.vaultToken,
		VaultConfig:          vaultConfig,

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Add or fix the vault block for that cluster name in the client agent's config and restart the agent
2. Correct the task's vault cluster name to match an existing client vault config
3. Verify the client config includes the cluster before submitting jobs
4. If Vault is unused, remove the vault block from the task

Example fix

// before (job)
vault { cluster = "prod-vault-2" }
// after (client only has the default cluster configured)
vault { cluster = "default" }

# verify the client has the vault cluster before submitting the job
grep -A3 'vault' /etc/nomad.d/client.hcl
# confirm the job's vault cluster name matches a client stanza:
# vault { cluster "prod-vault" { ... } }

vaultConfig := clientConfig.GetVaultConfigs(logger)[task.GetVaultClusterName()]
if task.Vault != nil && vaultConfig == nil {
    return fmt.Errorf("vault cluster %q missing from client config; add vault.cluster stanza or fix the job", vaultCluster)
}

When it happens

Trigger: A task's vault block references a cluster whose name has no matching vault { cluster <name> { ... } } stanza in the Nomad client agent config, or vault is entirely unconfigured/disabled on the client.

Common situations: Multi-cluster Vault setups where the job's vault.cluster value doesn't match any client vault stanza; forgetting to add the new cluster's config to client agents after introducing vault.cluster in jobs; typos in the cluster name.

Related errors

• No client configuration found for Vault cluster %s
• failed to create vault client for cluster %q
• failed to recover vault token from %s: %v
• failed to write Vault token to disk: %w
• failed to validate volume %s, err: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0ca72aad4eced471. Report an issue: GitHub.