{"record":{"id":"8390cccdd839d82f","repo":"grafana/k6","slug":"generating-idempotency-key-w","errorCode":null,"errorMessage":"generating idempotency key: %w","messagePattern":"generating idempotency key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloudapi/provisioning/api.go","lineNumber":195,"sourceCode":"\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\treturn ctx.Err()\n\t\tcase <-time.After(pollInterval):\n\t\t\t// continue polling\n\t\t}\n\t}\n}\n\n// StartLocalExecution starts a local-execution test run via the\n// provisioning API. It generates a K6-Idempotency-Key header for\n// safe retries. The caller provides options as pre-marshalled JSON.\nfunc (c *Client) StartLocalExecution(\n\tctx context.Context, loadTestID int64, req StartLocalExecutionRequest,\n) (*StartLocalExecutionResponse, error) {\n\t// Generate idempotency key: 8 random bytes hex-encoded (16 chars).\n\tvar key [8]byte\n\tif _, err := rand.Read(key[:]); err != nil {\n\t\treturn nil, fmt.Errorf(\"generating idempotency key: %w\", err)\n\t}\n\n\t// SDK adapter: unmarshal json.RawMessage → map[string]any.\n\tvar opts map[string]any\n\tif err := json.Unmarshal(req.Options, &opts); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling options for SDK: %w\", err)\n\t}\n\n\tmaxVUs, err := toInt32(req.MaxVUs)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"max_vus: %w\", err)\n\t}\n\ttotalDuration, err := toInt32(req.TotalDuration)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"total_duration: %w\", err)\n\t}\n\n\tsdkReq := k6cloud.NewStartLocalExecutionTestRequest(opts, maxVUs, totalDuration)","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/cloudapi/provisioning/api.go#L177-L213","documentation":"Client.StartLocalExecution (internal/cloudapi/provisioning/api.go:195) generates an 8-byte random K6-Idempotency-Key header via crypto/rand before calling the API. This error means the OS CSPRNG could not be read. On modern platforms crypto/rand essentially never fails; failure indicates a broken or restricted environment (kernel without getrandom(2), aggressive seccomp/sandbox).","triggerScenarios":"rand.Read(key[:]) returns an error: pre-3.17 Linux kernel without getrandom, container seccomp profile blocking the syscall, or an exotic OS without a usable entropy source.","commonSituations":"Minimal Docker images with strict seccomp/AppArmor profiles; very old kernels or WSL1-era environments; embedded/virtualized hosts with blocked syscall surfaces.","solutions":["Run in an environment where crypto/rand works (kernel >= 3.17, unblocked getrandom)","Inspect the container's seccomp profile and allow getrandom(2)","On old systems check /proc/sys/kernel/random/entropy_avail; the fix is environmental, not code-level","Retry the k6 run once entropy/services are confirmed healthy"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := rand.Read(key[:]); err != nil {\n\t// environmental: verify getrandom availability, then retry once\n\tif _, err2 := rand.Read(key[:]); err2 != nil {\n\t\treturn fmt.Errorf(\"CSPRNG unavailable: %w\", err2)\n\t}\n}","preventionTips":["Test containers/hosts for crypto/rand availability before deploying","Keep seccomp profiles permissive for getrandom(2)","Treat recurrence as an environment defect, not a code defect"],"tags":["crypto","entropy","sandbox","environment","idempotency"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}