{"record":{"id":"5658e7b7f58bc072","repo":"cilium/cilium","slug":"failed-to-create-ipsec-key-w","errorCode":null,"errorMessage":"failed to create IPsec key: %w","messagePattern":"failed to create IPsec key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/encrypt/ipsec_new_key.go","lineNumber":28,"sourceCode":"\n\tcorev1 \"k8s.io/api/core/v1\"\n\tk8sErrors \"k8s.io/apimachinery/pkg/api/errors\"\n\tmetav1 \"k8s.io/apimachinery/pkg/apis/meta/v1\"\n\n\t\"github.com/cilium/cilium/cilium-cli/defaults\"\n)\n\nfunc (s *Encrypt) IPsecNewKey(ctx context.Context) error {\n\tctx, cancelFn := context.WithTimeout(ctx, s.params.WaitDuration)\n\tdefer cancelFn()\n\n\tif err := s.checkEncryptionSecretNotExists(ctx); err != nil {\n\t\treturn err\n\t}\n\n\tnewKey, err := createIPsecKey(s.params.IPsecKeyAuthAlgo)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create IPsec key: %w\", err)\n\t}\n\n\tif err := s.createEncryptionSecret(ctx, newKey); err != nil {\n\t\treturn err\n\t}\n\n\tfmt.Printf(\"IPsec key successfully created, new key SPI: %d\\n\", newKey.spi)\n\treturn nil\n}\n\nfunc (s *Encrypt) checkEncryptionSecretNotExists(ctx context.Context) error {\n\t_, err := s.client.GetSecret(ctx, s.params.CiliumNamespace, defaults.EncryptionSecretName, metav1.GetOptions{})\n\tif err == nil {\n\t\treturn errors.New(\"IPsec secret already exists, rotate key if needed using `cilium encryption rotate-key` command\")\n\t}\n\tif !k8sErrors.IsNotFound(err) {\n\t\treturn fmt.Errorf(\"failed to check if IPsec secret exists: %w\", err)\n\t}","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/encrypt/ipsec_new_key.go#L10-L46","documentation":"IPsecNewKey wraps any failure from createIPsecKey, the function that generates a new random IPsec key for the configured authentication algorithm. The wrapped error indicates key generation itself failed (not secret creation or existence checks).","triggerScenarios":"Running 'cilium encryption create-key' (IPsecNewKey) where createIPsecKey(s.params.IPsecKeyAuthAlgo) returns an error — e.g. rotators lookup/dispatch failing for the given algo or the underlying generator erroring.","commonSituations":"Passing an unsupported --ipsec-key-auth-algo value with no registered rotator; environment entropy issues in constrained CI containers.","solutions":["Check the --ipsec-key-auth-algo flag value; use a supported algorithm (e.g. gcm-aes)","Read the wrapped error for the root cause and fix that condition","Retry the command; key generation is side-effect free until the secret is created"],"exampleFix":"// before\ncilium encryption create-key --ipsec-key-auth-algo bogus\n// after\ncilium encryption create-key --ipsec-key-auth-algo gcm-aes","handlingStrategy":"try-catch","validationCode":"const supported = ['gcm-aes'] // check rotators registry\nif (!supported.includes(args.ipsecKeyAuthAlgo)) throw new Error(`unsupported algo: ${args.ipsecKeyAuthAlgo}`)","typeGuard":"function isSupportedAlgo(a) { return typeof a === 'string' && ['gcm-aes'].includes(a) }","tryCatchPattern":"try { await IPsecNewKey(ctx) } catch (err) { if (/failed to create IPsec key/.test(err.message)) { log('key generation failed:', err.cause) } else throw err }","preventionTips":["Pin the --ipsec-key-auth-algo flag to a documented value in scripts/CI","Read the wrapped cause (%w) to identify the real failure","Ensure container has adequate entropy (/dev/urandom)"],"tags":["ipsec","key-generation","cilium","cli"],"backgroundTag":"ipsec-key-generation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}