{"record":{"id":"26b5d20bdf19a56e","repo":"hashicorp/nomad","slug":"failed-to-copy-certificate-secrets-s-w","errorCode":null,"errorMessage":"failed to copy certificate secrets/%s: %w","messagePattern":"failed to copy certificate secrets/(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/connect_native_hook.go","lineNumber":165,"sourceCode":"\tif source == \"\" {\n\t\treturn nil\n\t}\n\n\toriginal, err := os.Open(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open consul TLS certificate: %w\", err)\n\t}\n\tdefer original.Close()\n\n\tdestination := filepath.Join(dir, name)\n\tfd, err := os.Create(destination)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create secrets/%s: %w\", name, err)\n\t}\n\tdefer fd.Close()\n\n\tif _, err := io.Copy(fd, original); err != nil {\n\t\treturn fmt.Errorf(\"failed to copy certificate secrets/%s: %w\", name, err)\n\t}\n\n\tif err := fd.Sync(); err != nil {\n\t\treturn fmt.Errorf(\"failed to write secrets/%s: %w\", name, err)\n\t}\n\n\treturn nil\n}\n\n// tlsEnv creates a set of additional of environment variables to be used when launching\n// the connect native task. This will enable the task to communicate with Consul\n// if Consul has transport security turned on.\n//\n// We do NOT set CONSUL_HTTP_TOKEN from the nomad agent's consul config, as that\n// is a separate security concern addressed by the service identity hook.\nfunc (h *connectNativeHook) tlsEnv(env map[string]string) map[string]string {\n\tm := make(map[string]string)\n","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/connect_native_hook.go#L147-L183","documentation":"Returned by copyCertificate when io.Copy fails while copying a Consul TLS certificate file into the allocation's secrets directory. The source was opened and destination created, but the byte transfer itself failed.","triggerScenarios":"Thrown at client/allocrunner/taskrunner/connect_native_hook.go:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check client disk health and free space","Re-open/verify the source certificate file is readable","Restart the allocation to retry the copy"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}