{"record":{"id":"38c1cf135e23641e","repo":"hashicorp/nomad","slug":"root-key-not-found","errorCode":null,"errorMessage":"root key not found","messagePattern":"root key not found","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/keyring_endpoint.go","lineNumber":351,"sourceCode":"\n\tif args.KeyID == \"\" {\n\t\treturn fmt.Errorf(\"root key ID is required\")\n\t}\n\n\t// lookup any existing key and validate the delete\n\tvar index uint64\n\tsnap, err := k.srv.fsm.State().Snapshot()\n\tif err != nil {\n\t\treturn err\n\t}\n\tws := memdb.NewWatchSet()\n\trootKey, err := snap.RootKeyByID(ws, args.KeyID)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif rootKey == nil {\n\t\treturn errors.New(\"root key not found\")\n\t}\n\n\tif rootKey != nil && rootKey.IsActive() {\n\t\treturn fmt.Errorf(\"active root key cannot be deleted - call rotate first\")\n\t}\n\n\t// make sure the key was used to encrypt an existing variable\n\trootKeyInUse, err := snap.IsRootKeyInUse(args.KeyID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif rootKeyInUse && !args.Force {\n\t\treturn errors.New(\"root key in use, cannot delete\")\n\t}\n\n\t_, index, err = k.srv.raftApply(structs.WrappedRootKeysDeleteRequestType, args)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/keyring_endpoint.go#L333-L369","documentation":"The keyring Delete RPC removes a root key used for variables encryption. If the state store has no root key with the requested KeyID, the endpoint returns this error instead of proceeding to the raft apply.","triggerScenarios":"Calling the root key delete API/CLI (`nomad keyring remove -key-id <id>`) with a key ID that does not exist in the state store (already deleted, typo'd, or from another cluster).","commonSituations":"Deleting a key twice in parallel; typing the key ID by hand; targeting the wrong cluster/namespace via environment config.","solutions":["Run `nomad keyring list` and copy the exact key ID.","Retry with the correct, existing key ID.","If the key was already deleted, treat the operation as complete."],"exampleFix":"// before\nnomad keyring remove -key-id 8f2b...wrong\n\n// after\nnomad keyring list\nnomad keyring remove -key-id <id-from-list>","handlingStrategy":"try-catch","validationCode":"// verify existence first\nkeys, err := client.Keyring().List(nil)\n// then confirm args.KeyID appears in keys before calling Delete","typeGuard":null,"tryCatchPattern":"if _, err := k.Delete(args); err != nil && strings.Contains(err.Error(), \"root key not found\") {\n  // treat as already-deleted; re-list keys to confirm\n  return handleAlreadyDeleted(args.KeyID)\n}","preventionTips":["Always list keys via `nomad keyring list` before removing","Never retype key IDs; copy them programmatically","Confirm you are pointed at the intended cluster"],"tags":["nomad","keyring","variables","not-found"],"backgroundTag":"resource-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}