{"record":{"id":"d69a2bb8ed28601b","repo":"hashicorp/nomad","slug":"failed-to-write-secrets-s-w","errorCode":null,"errorMessage":"failed to write secrets/%s: %w","messagePattern":"failed to write secrets/(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/taskrunner/connect_native_hook.go","lineNumber":169,"sourceCode":"\toriginal, err := os.Open(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open consul TLS certificate: %w\", err)\n\t}\n\tdefer original.Close()\n\n\tdestination := filepath.Join(dir, name)\n\tfd, err := os.Create(destination)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create secrets/%s: %w\", name, err)\n\t}\n\tdefer fd.Close()\n\n\tif _, err := io.Copy(fd, original); err != nil {\n\t\treturn fmt.Errorf(\"failed to copy certificate secrets/%s: %w\", name, err)\n\t}\n\n\tif err := fd.Sync(); err != nil {\n\t\treturn fmt.Errorf(\"failed to write secrets/%s: %w\", name, err)\n\t}\n\n\treturn nil\n}\n\n// tlsEnv creates a set of additional of environment variables to be used when launching\n// the connect native task. This will enable the task to communicate with Consul\n// if Consul has transport security turned on.\n//\n// We do NOT set CONSUL_HTTP_TOKEN from the nomad agent's consul config, as that\n// is a separate security concern addressed by the service identity hook.\nfunc (h *connectNativeHook) tlsEnv(env map[string]string) map[string]string {\n\tm := make(map[string]string)\n\n\tif _, exists := env[\"CONSUL_CACERT\"]; !exists && h.consulConfig.CAFile != \"\" {\n\t\tm[\"CONSUL_CACERT\"] = filepath.Join(\"/secrets\", secretCAFilename)\n\t}\n","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/taskrunner/connect_native_hook.go#L151-L187","documentation":"Fires in copyCertificate while persisting a Consul TLS certificate into the allocation's secrets dir: the file was created and copied, but fd.Sync failed (typically a full disk or fs error), so the bytes may not be durable.","triggerScenarios":"Thrown at client/allocrunner/taskrunner/connect_native_hook.go:169 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check disk health (I/O errors in dmesg) and free space","Verify filesystem supports fsync and is not failing","Restart the allocation to retry the certificate write"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}