{"record":{"id":"b83a088a0b156711","repo":"hashicorp/nomad","slug":"could-not-read-path-s-from-keystore-v","errorCode":null,"errorMessage":"could not read path %s from keystore: %v","messagePattern":"could not read path (.+?) from keystore: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"nomad/encrypter.go","lineNumber":159,"sourceCode":"\t// default to false as this will be parsed by the go-kms-wrapping package\n\tskipVerify := \"\"\n\tif vaultcfg.TLSSkipVerify != nil {\n\t\tskipVerify = fmt.Sprintf(\"%v\", *vaultcfg.TLSSkipVerify)\n\t}\n\tsetFallback(\"tls_skip_verify\", skipVerify, \"VAULT_SKIP_VERIFY\", \"false\")\n}\n\nfunc (e *Encrypter) loadKeystore() error {\n\n\tif err := os.MkdirAll(e.keystorePath, 0o700); err != nil {\n\t\treturn err\n\t}\n\n\tkeyErrors := map[string]error{}\n\n\tfilepath.Walk(e.keystorePath, func(path string, info fs.FileInfo, err error) error {\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not read path %s from keystore: %v\", path, err)\n\t\t}\n\n\t\t// skip over subdirectories and non-key files; they shouldn't\n\t\t// be here but there's no reason to fail startup for it if the\n\t\t// administrator has left something there\n\t\tif path != e.keystorePath && info.IsDir() {\n\t\t\treturn filepath.SkipDir\n\t\t}\n\t\tif !strings.HasSuffix(path, nomadKeystoreExtension) {\n\t\t\treturn nil\n\t\t}\n\t\tidWithIndex := strings.TrimSuffix(filepath.Base(path), nomadKeystoreExtension)\n\t\tid, _, _ := strings.Cut(idWithIndex, \".\")\n\t\tif !helper.IsUUID(id) {\n\t\t\treturn nil\n\t\t}\n\n\t\te.keyringLock.RLock()","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L141-L177","documentation":"Encrypter startup walks the on-disk keystore directory to load encryption keys; if filepath.Walk reports any error for a path (unreadable directory, permission denied, etc.), Nomad returns this error naming the path and underlying cause. It signals the keystore cannot be fully read and keys may be missing.","triggerScenarios":"During Encrypter initialization, filepath.Walk(e.keystorePath) invokes the callback with a non-nil err — e.g. the keystore directory doesn't exist, lacks read permission, or contains an unreadable entry.","commonSituations":"Misconfigured keystore_path in server config pointing to a missing or wrong directory; incorrect file ownership/permissions after migration or container image changes; keystore on a volume that failed to mount; running Nomad as a user without access to the key files.","solutions":["Verify the keystore path in the server config exists and is readable by the Nomad process user: ls -ld <keystore_path>","Fix permissions/ownership (chown/chmod) on the keystore directory and key files","If the mount/volume hosting the keystore is missing, remount it and restart the server","Correct or create the keystore directory, then re-run the server; keys are needed for workload encryption (JWT/Vault-adjacent features)"],"exampleFix":"// before: server config points at a missing dir\nserver { encryption { keystore_path = \"/opt/nomad/keys\" } }  # /opt/nomad/keys missing\n// after\nmkdir -p /opt/nomad/keys && chown nomad:nomad /opt/nomad/keys && chmod 700 /opt/nomad/keys\n","handlingStrategy":"validation","validationCode":"const fs = require('fs')\nfunction keystoreReadable(p) {\n  try { fs.accessSync(p, fs.constants.R_OK | fs.constants.X_OK); return fs.statSync(p).isDirectory() }\n  catch { return false }\n}\nkeystoreReadable('/var/lib/nomad/keystore') // true means safe to start server","typeGuard":null,"tryCatchPattern":"try {\n  encrypter.loadKeystore()\n} catch (e) {\n  if (e.message.startsWith('could not read path')) {\n    const p = e.message.split(' ')[4]\n    // fix perms/mount then retry\n    fixKeystorePerms(p); encrypter.loadKeystore()\n  } else { throw e }\n}","preventionTips":["Pre-provision the keystore directory with correct ownership for the Nomad user before startup","Verify keystore_path in server config matches an existing, mounted volume","After container/VM image updates, re-check permissions on the keystore","Run startup health checks that stat the keystore path before launching nomad agent"],"tags":["nomad","keystore","filesystem","permissions","encryption"],"backgroundTag":"keystore-path-unreadable","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}