vault Block in Agent Configuration

This page provides reference information for configuring Nomad server and client integration with HashiCorp Vault in the vault block of a Nomad agent configuration. Configure cluster name and the role for creating tokens. For Nomad clients, configure Vault's address, namespace, and certificate or TLS authentication. Specify the JWT authentication path. For Nomad servers, configure the server's default workload identity, which includes workload identity recipients, workload TTL, and key-value pairs for additional identity claims.

When configured, job tasks can use workload identities to receive Vault ACL tokens automatically.

Alternatively, Nomad servers may be configured with a high-privileged Vault token that is used to derive fine-grained tokens for tasks. Refer to Token-Based Authentication for configuration details. However, we strongly recommend using workload identities since token-based authentication is deprecated.

Refer to the Nomad and Vault Integration page for more information about the Vault integration.

vault {
  enabled = true

  default_identity {
    aud = ["vault.io"]
    ttl = "1h"

    extra_claims {
      unique_id = "${job.region}:${job.namespace}:${job.id}"
    }