{"record":{"id":"3b72ba78435fea5b","repo":"hashicorp/nomad","slug":"could-not-re-encode-redacted-key-v","errorCode":null,"errorMessage":"Could not re-encode redacted key: %v","messagePattern":"Could not re-encode redacted key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/raftutil/snapshot.go","lineNumber":85,"sourceCode":"\tfor {\n\t\traw := iter.Next()\n\t\tif raw == nil {\n\t\t\tbreak\n\t\t}\n\t\trootKey := raw.(*structs.RootKey)\n\t\tif rootKey == nil {\n\t\t\tbreak\n\t\t}\n\t\tif len(rootKey.WrappedKeys) > 0 {\n\t\t\trootKey.KeyID = rootKey.KeyID + \" [REDACTED]\"\n\t\t\trootKey.WrappedKeys = nil\n\t\t}\n\t\tmsg, err := structs.Encode(structs.WrappedRootKeysUpsertRequestType,\n\t\t\t&structs.KeyringUpsertWrappedRootKeyRequest{\n\t\t\t\tWrappedRootKeys: rootKey,\n\t\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Could not re-encode redacted key: %v\", err)\n\t\t}\n\n\t\tfsm.Apply(&raft.Log{\n\t\t\tType: raft.LogCommand,\n\t\t\tData: msg,\n\t\t})\n\t}\n\n\tsnap, err := snapshot.NewFromFSM(hclog.Default(), fsm, meta)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to create redacted snapshot: %v\", err)\n\t}\n\n\tsrcFile.Truncate(0)\n\tsrcFile.Seek(0, 0)\n\n\t_, err = io.Copy(srcFile, snap)\n\tif err != nil {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/raftutil/snapshot.go#L67-L103","documentation":"Each redacted root key is re-encoded into a structs.WrappedRootKeysUpsertRequest message to be replayed into the FSM. This error wraps a failure of structs.Encode on that message. It indicates the in-memory key structure could not be msgpack/codec-encoded, i.e., the data read from the snapshot is structurally invalid for the encoder.","triggerScenarios":"structs.Encode(structs.WrappedRootKeysUpsertRequestType, &structs.KeyringUpsertWrappedRootKeyRequest{...}) failing while iterating RootKeys — codec errors from unexpected field types in a decoded root key, nil/malformed key material, or a type/version mismatch between the decoded key and the current structs definitions.","commonSituations":"Cross-version redaction: snapshot written by a Consul version whose keyring struct differs from the tool's compiled structs, yielding keys that decode but cannot re-encode.","solutions":["Rebuild/redact using a binary of the same version that produced the snapshot.","Inspect the embedded encode error to find the offending field and key; if a single key is corrupt, restore the snapshot to a test cluster and rotate the keyring instead.","Upgrade the tooling to a version whose structs.WrappedRootKeysUpsertRequestType codec matches the snapshot format.","Re-take the snapshot from the live cluster and retry."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := raftutil.RedactSnapshot(f); err != nil {\n    if strings.Contains(err.Error(), \"Could not re-encode redacted key\") {\n        log.Printf(\"keyring re-encode failed (likely version mismatch): %v\", err)\n    }\n}","preventionTips":["Run the redaction tool built from the same source version as the snapshot producer.","Rotate the keyring on a test cluster if individual keys cannot be re-encoded.","Keep snapshot tooling updated with the structs/codec definitions."],"tags":["raft","snapshot","encoding","msgpack","go"],"backgroundTag":"msgpack-encode-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}