{"record":{"id":"c75c6cf0af9caabe","repo":"kubernetes/kops","slug":"error-getting-random-data-w","errorCode":null,"errorMessage":"error getting random data: %w","messagePattern":"error getting random data: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/commands/toolbox_enroll.go","lineNumber":354,"sourceCode":"}\n\nfunc (s *SSHHost) readFile(ctx context.Context, path string) ([]byte, error) {\n\tp := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)\n\n\treturn p.ReadFile(ctx)\n}\n\nfunc (s *SSHHost) writeFile(ctx context.Context, path string, data io.ReadSeeker) error {\n\tp := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)\n\treturn p.WriteFile(ctx, data, nil)\n}\n\nfunc (s *SSHHost) runScript(ctx context.Context, script string, options ExecOptions) (*CommandOutput, error) {\n\tvar tempDir string\n\t{\n\t\tb := make([]byte, 32)\n\t\tif _, err := cryptorand.Read(b); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error getting random data: %w\", err)\n\t\t}\n\t\ttempDir = path.Join(\"/tmp\", hex.EncodeToString(b))\n\t}\n\n\tscriptPath := path.Join(tempDir, \"script.sh\")\n\n\tp := vfs.NewSSHPath(s.sshClient, s.hostname, scriptPath, s.sudo)\n\n\tdefer func() {\n\t\tif _, err := s.runCommand(ctx, \"rm -rf \"+tempDir, ExecOptions{Echo: false}); err != nil {\n\t\t\tklog.Warningf(\"error cleaning up temp directory %q: %v\", tempDir, err)\n\t\t}\n\t}()\n\n\tif err := p.WriteFile(ctx, bytes.NewReader([]byte(script)), nil); err != nil {\n\t\treturn nil, fmt.Errorf(\"error writing script to SSH target: %w\", err)\n\t}\n","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/toolbox_enroll.go#L336-L372","documentation":"runScript generates a unique remote temp directory name using crypto/rand (32 bytes, hex-encoded). If the CSPRNG read fails — essentially only on a broken system entropy source — this error is returned and the script is not staged.","triggerScenarios":"cryptorand.Read(b) returns an error for the 32-byte buffer: getrandom(2) failing on the remote-local Go runtime, e.g. entropy initialization failure in constrained containers or kernel issues.","commonSituations":"Running kops inside a heavily restricted container/seccomp sandbox that blocks getrandom; early-boot environments where /dev/urandom and getrandom are unavailable; essentially never seen on normal hosts.","solutions":["Check host entropy health: dmesg for random: crng init failures; upgrade kernel if affected","Rerun the command on a normal host/container without restrictive seccomp filters","Inspect the wrapped errno in the error for the syscall that failed","If in a container, relax seccomp to allow getrandom or run with --security-opt seccomp=unconfined to test"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"b := make([]byte, 32)\nif _, err := cryptorand.Read(b); err != nil {\n    return fmt.Errorf(\"system CSPRNG unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"host, err := NewSSHHost(...); _, err = sshHost.runScript(ctx, script, opts)\nif err != nil && strings.Contains(err.Error(), \"error getting random data\") {\n    return fmt.Errorf(\"host entropy broken; check dmesg for crng init failures\")\n}","preventionTips":["Avoid running kops in seccomp sandboxes that block getrandom","Keep kernels recent enough for reliable getrandom","Treat this as an environment fault, not a code bug — fix the host"],"tags":["crypto","random","entropy"],"backgroundTag":"crypto-rand-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}