{"record":{"id":"94d1ebeb7f64a2bf","repo":"argoproj/argo-workflows","slug":"failed-to-generate-key-w","errorCode":null,"errorMessage":"failed to generate key: %w","messagePattern":"failed to generate key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":182,"sourceCode":"\t}\n\tvar logoutURL string\n\tif claimsErr := provider.Claims(&providerMetadata); claimsErr == nil {\n\t\tlogoutURL = providerMetadata.EndSessionEndpoint\n\t} else {\n\t\tlogging.RequireLoggerFromContext(ctx).WithError(claimsErr).Warn(ctx, \"Failed to read OIDC provider metadata; provider logout disabled\")\n\t}\n\tvar clientIDObj *apiv1.Secret\n\tif c.ClientID.Name == c.ClientSecret.Name {\n\t\tclientIDObj = clientSecretObj\n\t} else {\n\t\tclientIDObj, err = secretsIf.Get(ctx, c.ClientID.Name, metav1.GetOptions{})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\tgeneratedKey, err := rsa.GenerateKey(rand.Reader, 2048)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate key: %w\", err)\n\t}\n\t// whoa - are you ignoring errors - yes - we don't care if it fails -\n\t// if it fails, then the get will fail, and the pod restart\n\t// it may fail due to race condition with another pod - which is fine,\n\t// when it restart it'll get the new key\n\t_, err = secretsIf.Create(ctx, &apiv1.Secret{\n\t\tObjectMeta: metav1.ObjectMeta{Name: secretName},\n\t\tData:       map[string][]byte{cookieEncryptionPrivateKeySecretKey: x509.MarshalPKCS1PrivateKey(generatedKey)},\n\t}, metav1.CreateOptions{})\n\tisSecretAlreadyExists := false\n\tif err != nil {\n\t\tisSecretAlreadyExists = apierr.IsAlreadyExists(err)\n\t\tif !isSecretAlreadyExists {\n\t\t\treturn nil, fmt.Errorf(\"failed to create secret: %w\", err)\n\t\t}\n\t}\n\tsecret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})\n\tif err != nil {","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L164-L200","documentation":"newSso generates the cookie-encryption RSA key with crypto/rsa GenerateKey(rand.Reader, 2048). If the crypto/rand reader fails, the error is wrapped with this message. This is extremely rare — it means the OS entropy source failed.","triggerScenarios":"rsa.GenerateKey returning a non-nil error during New() at argo-server startup, which in practice only happens when the OS CSPRNG (getrandom/urandom) is unavailable or returns an error.","commonSituations":"Running in a sandbox/container with a broken or blocked /dev/urandom or getrandom syscall; heavily degraded host entropy; exotic hardened kernels blocking getrandom.","solutions":["Inspect the wrapped error returned by rsa.GenerateKey for the OS-level cause","Verify /dev/urandom works in the argo-server container (od -An -N8 -tx1 /dev/urandom)","Restart the pod — this is a transient environment failure, not a config problem","Check kernel/seccomp settings that may block getrandom"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure)\nif err != nil && strings.Contains(err.Error(), \"failed to generate key\") {\n    // transient OS entropy failure: restart via normal pod retry\n    return fmt.Errorf(\"transient RNG failure, pod will restart: %w\", err)\n}","preventionTips":["Ensure /dev/urandom is available and not masked in the container","Avoid seccomp/apparmor profiles that block getrandom","Treat as transient — rely on kubernetes restart policy"],"tags":["crypto","entropy","runtime"],"backgroundTag":"crypto-rand-failure","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}