What causes "Vault %q not enabled but used in the job" in hashicorp/nomad?

Enable Vault in the Nomad server configuration (vault { enabled = true ... }) and restart the servers.

Vault %q not enabled but used in the job

Error message

Vault %q not enabled but used in the job

What it means

The job validation hook for Vault checks each job's vault block cluster against the server's configured Vault cluster configs. If the referenced cluster's config is missing or its IsEnabled() is false, the job is rejected because it requests Vault integration that the Nomad server has not enabled.

Source

Thrown at nomad/job_endpoint_hook_vault.go:31

type jobVaultHook struct {
	srv *Server
}

func (jobVaultHook) Name() string {
	return "vault"
}

func (h jobVaultHook) Validate(job *structs.Job) ([]error, error) {
	vaultBlocks := job.Vault()
	if len(vaultBlocks) == 0 {
		return nil, nil
	}

	for _, tg := range vaultBlocks {
		for _, vaultBlock := range tg {
			vconf := h.srv.config.VaultConfigs[vaultBlock.Cluster]
			if !vconf.IsEnabled() {
				return nil, fmt.Errorf("Vault %q not enabled but used in the job",
					vaultBlock.Cluster)
			}
		}
	}

	// Check namespaces.
	if err := h.validateNamespaces(vaultBlocks); err != nil {
		return nil, err
	}

	return nil, h.validateClustersForNamespace(job, vaultBlocks)
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Enable Vault in the Nomad server configuration (vault { enabled = true ... }) and restart the servers.
Remove the vault {} stanza from the job if Vault integration is not needed.
Set the vault block's cluster field to a configured cluster name that is enabled (e.g. the default cluster).

Example fix

// before
# nomad server config has no vault block
job "web" {
  group "g" {
    task "t" {
      vault { cluster = "prod" }
    }
  }
}
// after
# nomad server config:
# vault { enabled = true address = "https://vault:8200" }
job "web" {
  group "g" {
    task "t" {
      vault { cluster = "default" }
    }
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// before submit: verify vault is enabled on the target cluster
confs, _, err := client.Operator().Vault().ListConfigurations(nil)
if err != nil { return err }
enabled := false
for _, c := range confs {
  if c.Enabled != nil && *c.Enabled { enabled = true }
}
if !enabled && jobUsesVault(job) {
  return errors.New("job uses vault but no Vault cluster is enabled on this Nomad server")
}

Type guard

func jobUsesVault(j *api.Job) bool {
	for _, tg := range j.TaskGroups {
		for _, t := range tg.Tasks {
			if t.Vault != nil {
				return true
			}
		}
	}
	return false
}

Try / catch

// golang
_, _, err := client.Jobs().Validate(job, nil)
if err != nil && strings.Contains(err.Error(), "not enabled but used in the job") {
	// strip vault blocks or enable Vault on the server before resubmitting
}

Prevention

Verify `vault status` / Nomad agent config shows vault { enabled = true } before deploying Vault-dependent jobs.
Keep vault cluster names consistent across environments or omit the cluster field to use the default.
Gate Vault-dependent deployments on a capability check against the Nomad API.
Restart Nomad servers after changing vault configuration so the new config takes effect.

When it happens

Trigger: Submitting a job containing a vault {} stanza whose cluster names a Vault cluster that is not configured in the server's vault { cluster ... enabled = true } configuration, or when no Vault config exists for that cluster name (vconf nil/default => not enabled).

Common situations: Vault disabled in the Nomad server config (or server not restarted after adding the vault block); jobs from an environment with Vault submitted to a cluster without it; multi-cluster jobs referencing a non-default vault cluster name that only exists elsewhere; Vault token/allow_unauthenticated misconfig making the cluster effectively disabled.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1634f6d7ac4024dc. Report an issue: GitHub.