{"record":{"id":"5f5c496aad215b7e","repo":"hashicorp/nomad","slug":"failed-to-generate-root-key-w","errorCode":null,"errorMessage":"failed to generate root key: %w","messagePattern":"failed to generate root key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"nomad/structs/keyring.go","lineNumber":67,"sourceCode":"\t// RS256 algorithm. It is stored in its PKCS #1, ASN.1 DER form. See\n\t// x509.MarshalPKCS1PrivateKey for details.\n\tRSAKey []byte\n}\n\n// NewUnwrappedRootKey returns a new root key and its metadata.\nfunc NewUnwrappedRootKey(algorithm EncryptionAlgorithm) (*UnwrappedRootKey, error) {\n\tmeta := NewRootKeyMeta()\n\tmeta.Algorithm = algorithm\n\n\trootKey := &UnwrappedRootKey{\n\t\tMeta: meta,\n\t}\n\n\tswitch algorithm {\n\tcase EncryptionAlgorithmAES256GCM:\n\t\tkey, err := crypto.Bytes(32)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to generate root key: %w\", err)\n\t\t}\n\t\trootKey.Key = key\n\t}\n\n\t// Generate RSA key for signing workload identity JWTs with RS256.\n\trsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate rsa key: %w\", err)\n\t}\n\n\trootKey.RSAKey = x509.MarshalPKCS1PrivateKey(rsaPrivateKey)\n\n\treturn rootKey, nil\n}\n\nfunc (k *UnwrappedRootKey) Copy() *UnwrappedRootKey {\n\treturn &UnwrappedRootKey{\n\t\tMeta:   k.Meta.Copy(),","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/keyring.go#L49-L85","documentation":"NewUnwrappedRootKey generates a 32-byte AES-256 key for the root keyring entry using crypto.Bytes; if entropy generation fails the key cannot be created and the underlying error is wrapped with this message.","triggerScenarios":"Creating a root key (NewUnwrappedRootKey) with EncryptionAlgorithmAES256GCM when crypto.Bytes(32) returns an error, typically from the OS entropy source (getrandom/read of /dev/urandom) failing.","commonSituations":"Kernel entropy exhaustion or getrandom blocking/failing in containers; seccomp/AppArmor policies blocking getrandom syscall; heavily restricted CI sandboxes.","solutions":["Fix the underlying entropy source (ensure getrandom syscall is permitted in the container/seccomp profile)","Restart the node or process so entropy is re-initialized","Upgrade the Go runtime/kernel if entropy-related bugs are implicated"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check entropy availability\ntmp := make([]byte, 32)\nif _, err := crand.Read(tmp); err != nil {\n  return fmt.Errorf(\"entropy unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"rootKey, err := structs.NewUnwrappedRootKey(alg)\nif err != nil && strings.Contains(err.Error(), \"failed to generate root key\") {\n  // inspect wrapped cause: fix entropy source, then retry\n}","preventionTips":["Ensure getrandom is allowed by container/seccomp profiles","Monitor entropy/health on Nomad servers","Retry root key generation only after fixing the entropy source"],"tags":["nomad","keyring","crypto","entropy"],"backgroundTag":"random-generation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}