{"record":{"id":"acaed543a3ddc482","repo":"hashicorp/nomad","slug":"no-such-key-q-in-keyring","errorCode":null,"errorMessage":"no such key %q in keyring","messagePattern":"no such key %q in keyring","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":777,"sourceCode":"\tkey, err := store.GetActiveRootKey(nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif key == nil {\n\t\treturn nil, fmt.Errorf(\"keyring has not been initialized yet\")\n\t}\n\n\tctx, cancel := context.WithTimeout(e.srv.shutdownCtx, time.Second)\n\tdefer cancel()\n\treturn e.waitForKey(ctx, key.KeyID)\n}\n\n// cipherSetByIDLocked returns the cipherSet for the specified keyID. The\n// caller must read-lock the keyring\nfunc (e *Encrypter) cipherSetByIDLocked(keyID string) (*cipherSet, error) {\n\tcipherSet, ok := e.keyring[keyID]\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"no such key %q in keyring\", keyID)\n\t}\n\treturn cipherSet, nil\n}\n\n// RemoveKey removes a key by ID from the keyring\nfunc (e *Encrypter) RemoveKey(keyID string) error {\n\te.keyringLock.Lock()\n\tdefer e.keyringLock.Unlock()\n\tdelete(e.keyring, keyID)\n\treturn nil\n}\n\n// wrapRootKey encrypts the key for every KEK provider and returns a RootKey\n// with wrapped keys. On legacy clusters, this also serializes the wrapped key\n// to the on-disk keystore.\nfunc (e *Encrypter) wrapRootKey(rootKey *structs.UnwrappedRootKey, isUpgraded bool) (*structs.RootKey, error) {\n\n\twrappedKeys := structs.NewRootKey(rootKey.Meta)","sourceCodeStart":759,"sourceCodeEnd":795,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L759-L795","documentation":"cipherSetByIDLocked looks up a keyring entry (a cipherSet holding the decrypted root key and related keys) by keyID in the Encrypter's in-memory keyring map. When no entry exists for the requested keyID, it returns \"no such key %q in keyring\". This means the key was never added, has been removed, or the caller is using a key ID the server does not know about.","triggerScenarios":"Calling Encrypter.GetKey, GetPublicKey, or AddWrappedKey with a keyID that is not present in e.keyring; after RemoveKey deleted the key; or before the key has been loaded/restored from the keyring store on server startup.","commonSituations":"Querying a key by a mistyped or stale key ID; a workload references a key that was rotated out and removed; a server that has not finished restoring keys from the state store receives a key request; multiple clusters/regions where the key only exists elsewhere.","solutions":["Verify the keyID passed to GetKey/GetPublicKey/AddWrappedKey matches an existing key (list keyring metadata via the API or state store).","If the key was removed intentionally, re-add it with AddWrappedKey or create a new key via the keyring API.","Check that the server has fully restored its keyring on startup (look for earlier keyring restore errors in the logs).","Confirm you are querying the correct cluster/region that holds the key."],"exampleFix":"// before\nkey, err := encrypter.GetKey(\"my-key-id\")\n// after\nif !encrypter.HasKey(\"my-key-id\") { // guard or list keys first\n  return fmt.Errorf(\"key %q not configured in keyring\", \"my-key-id\")\n}\nkey, err := encrypter.GetKey(\"my-key-id\")","handlingStrategy":"validation","validationCode":"if _, err := encrypter.GetKey(keyID); err != nil {\n    // treat as missing key; list keyring metadata or create the key first\n    return fmt.Errorf(\"key %q unavailable before use: %w\", keyID, err)\n}","typeGuard":null,"tryCatchPattern":"key, err := encrypter.GetKey(keyID)\nif err != nil && strings.Contains(err.Error(), \"no such key\") {\n    // handle missing key: create/rotate or fail fast with a clear message\n}","preventionTips":["Always resolve key IDs from the keyring metadata API rather than hardcoding them.","Check server startup logs for keyring restore completion before issuing key lookups.","Track key removals (RemoveKey) and update all consumers of the key ID."],"tags":["keyring","key-management","lookup-failed"],"backgroundTag":"missing-key-in-keyring","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}