hashicorp/nomad · error · ErrInvalidClientAssertionKeyPath

%w: must be absolute; got: %s

Error message

%w: must be absolute; got: %s

What it means

Part of OIDCClientAssertionKey.Validate(): when a PemKeyFile is provided it must be an absolute filesystem path, because the Nomad server reads the key material locally. A relative path cannot be resolved reliably, so validation fails with ErrInvalidClientAssertionKeyPath wrapped with this message.

Source

Thrown at nomad/structs/acl.go:1864

// Validate ensures that one Key and one Cert or KeyID are provided,
// and that the key ID header is valid for the provided KeyID or cert.
func (k *OIDCClientAssertionKey) Validate() error {
	if k == nil {
		return nil
	}

	// mutually exclusive key fields
	// must have key file or base64, but not both
	if k.PemKey == "" && k.PemKeyFile == "" {
		return ErrMissingClientAssertionKey
	}
	if k.PemKey != "" && k.PemKeyFile != "" {
		return ErrAmbiguousClientAssertionKey
	}
	if k.PemKeyFile != "" {
		if !path.IsAbs(k.PemKeyFile) {
			return fmt.Errorf("%w: must be absolute; got: %s", ErrInvalidClientAssertionKeyPath, k.PemKeyFile)
		}
	}

	// mutually exclusive cert fields
	// must have exactly one of: cert file or base64, or keyid
	if k.PemCert == "" && k.PemCertFile == "" && k.KeyID == "" {
		return ErrMissingClientAssertionKeyID
	}
	if k.PemCert != "" && (k.PemCertFile != "" || k.KeyID != "") {
		return ErrAmbiguousClientAssertionKeyID
	}
	if k.PemCertFile != "" && (k.PemCert != "" || k.KeyID != "") {
		return ErrAmbiguousClientAssertionKeyID
	}
	if k.KeyID != "" && (k.PemCert != "" || k.PemCertFile != "") {
		return ErrAmbiguousClientAssertionKeyID
	}
	if k.PemCertFile != "" {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change pem_key_file to an absolute path, e.g. /etc/nomad.d/keys/client.key.
2. If the path is generated dynamically, prefix it with the base directory at render time.
3. Alternatively inline the key via pem_key to avoid file paths entirely.

Example fix

// before
pem_key_file = "keys/client.key"

// after
pem_key_file = "/etc/nomad.d/keys/client.key"

if k.PemKeyFile != "" && !path.IsAbs(k.PemKeyFile) {
    return fmt.Errorf("pem_key_file must be absolute, got %q", k.PemKeyFile)
}

When it happens

Trigger: Submitting an OIDC client assertion key config with pem_key_file set to a relative path like "client.key" or "./keys/client.key" instead of "/etc/nomad/keys/client.key".

Common situations: Config written on a laptop with relative paths then deployed to the server; templating tools producing relative paths; assuming Nomad resolves paths relative to the config file.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing auth method name
• missing client nonce
• missing redirect URI

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/71a3fd1b67e3532e. Report an issue: GitHub.