{"record":{"id":"c9fc80ef1ee5b9c8","repo":"hashicorp/nomad","slug":"failed-to-query-for-root-keys-v","errorCode":null,"errorMessage":"Failed to query for root keys: %v","messagePattern":"Failed to query for root keys: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/raftutil/snapshot.go","lineNumber":64,"sourceCode":"\n\tselect {\n\tcase err := <-errCh:\n\t\treturn nil, nil, nil, err\n\tcase meta := <-metaCh:\n\t\treturn fsm, fsm.State(), meta, nil\n\t}\n}\n\nfunc RedactSnapshot(srcFile *os.File) error {\n\tsrcFile.Seek(0, 0)\n\tfsm, store, meta, err := RestoreFromArchive(srcFile, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to load snapshot from archive: %w\", err)\n\t}\n\n\titer, err := store.RootKeys(nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to query for root keys: %v\", err)\n\t}\n\n\tfor {\n\t\traw := iter.Next()\n\t\tif raw == nil {\n\t\t\tbreak\n\t\t}\n\t\trootKey := raw.(*structs.RootKey)\n\t\tif rootKey == nil {\n\t\t\tbreak\n\t\t}\n\t\tif len(rootKey.WrappedKeys) > 0 {\n\t\t\trootKey.KeyID = rootKey.KeyID + \" [REDACTED]\"\n\t\t\trootKey.WrappedKeys = nil\n\t\t}\n\t\tmsg, err := structs.Encode(structs.WrappedRootKeysUpsertRequestType,\n\t\t\t&structs.KeyringUpsertWrappedRootKeyRequest{\n\t\t\t\tWrappedRootKeys: rootKey,","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/raftutil/snapshot.go#L46-L82","documentation":"After restoring the snapshot into an in-memory store, RedactSnapshot enumerates root keys via store.RootKeys(nil) to rewrite them. This error wraps a failure of that key iteration, meaning the restored keyring store could not be opened or scanned. The underlying store error is embedded with %v (unwrappable).","triggerScenarios":"store.RootKeys(nil) returning an error after a successful restore — typically an in-memory store iteration/decode failure on the keyring data restored from the snapshot, or an unexpected store state (nil/misconfigured store passed to the FSM).","commonSituations":"Redacting snapshots whose keyring entries were written by very old or newer Consul versions with changed keyring encoding, or snapshots where the secure/keyring area is corrupt even though the archive parses.","solutions":["Inspect the embedded error to identify whether it is a decode or store-open failure and address that root cause.","Re-take the snapshot from a healthy cluster and retry the redaction.","Verify snapshot was produced by a compatible Consul version; upgrade the redaction tool if the keyring format is newer.","If only keyring data is corrupt, consider extracting state without keyring redaction or restoring the snapshot to a test cluster to regenerate it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := raftutil.RedactSnapshot(f); err != nil {\n    if strings.Contains(err.Error(), \"Failed to query for root keys\") {\n        log.Printf(\"keyring unreadable after restore: %v — re-take snapshot from a healthy cluster\", err)\n    }\n}","preventionTips":["Validate the snapshot with the vendor's inspect/verify command first.","Match tool version to the cluster version that wrote the keyring.","Test redaction on a copy before processing the only snapshot you have."],"tags":["raft","snapshot","keyring","go"],"backgroundTag":"snapshot-archive-corrupt","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}