{"record":{"id":"de96e6eb1877f2ff","repo":"hashicorp/nomad","slug":"failed-to-generate-key-wrapper-key-w","errorCode":null,"errorMessage":"failed to generate key wrapper key: %w","messagePattern":"failed to generate key wrapper key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":865,"sourceCode":"\t\twrappedKeys.WrappedKeys = append(wrappedKeys.WrappedKeys, wrappedKey)\n\n\t}\n\treturn wrappedKeys, nil\n}\n\n// encryptDEK encrypts the DEKs (one for encryption and one for signing) with\n// the KMS provider and returns a WrappedKey built from the provider's\n// kms.BlobInfo. This includes the cleartext KEK for the AEAD provider.\nfunc (e *Encrypter) encryptDEK(rootKey *structs.UnwrappedRootKey, provider *structs.KEKProviderConfig) (*structs.WrappedKey, error) {\n\tif provider == nil {\n\t\tpanic(\"can't encrypt DEK without a provider\")\n\t}\n\tvar kek []byte\n\tvar err error\n\tif provider.Provider == structs.KEKProviderAEAD || provider.Provider == \"\" {\n\t\tkek, err = crypto.Bytes(32)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to generate key wrapper key: %w\", err)\n\t\t}\n\t}\n\twrapper, err := e.newKMSWrapper(provider, rootKey.Meta.KeyID, kek)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create key wrapper: %w\", err)\n\t}\n\n\trootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to encrypt root key: %w\", err)\n\t}\n\n\tkekWrapper := &structs.WrappedKey{\n\t\tProvider:                 provider.Provider.String(),\n\t\tProviderID:               provider.ID(),\n\t\tWrappedDataEncryptionKey: rootBlob,\n\t\tWrappedRSAKey:            &kms.BlobInfo{},\n\t\tKeyEncryptionKey:         kek,","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L847-L883","documentation":"During encryptDEK, when the KEK provider is AEAD (or unspecified), a random 32-byte key-encryption key is generated with crypto.Bytes(32). If that entropy read fails, the code wraps the error as \"failed to generate key wrapper key\". Without a KEK, the root key cannot be wrapped, so key creation is aborted.","triggerScenarios":"crypto.Bytes(32) returns an error while encrypting a DEK/wrapping a root key for an AEAD-provider KEK wrapper — i.e., the CSPRNG-backed random byte generator failed.","commonSituations":"Degraded OS entropy sources on stripped-down containers or embedded hosts; failures in the crypto/rand reader under heavy startup load or restricted environments (e.g., seccomp blocking getrandom).","solutions":["Inspect the wrapped underlying error for the crypto/rand failure cause and fix the host entropy source.","Ensure /dev/urandom is available and getrandom(2) is not blocked by seccomp/AppArmor profiles in the container.","Retry the key rotation/creation operation once entropy is healthy.","Run on a kernel/platform with a working getrandom implementation (Linux 3.17+, modern Windows/macOS)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"kek, err := encryptDEK(...)\nif err != nil && strings.Contains(err.Error(), \"failed to generate key wrapper key\") {\n    // transient RNG failure: retry after checking host entropy health\n}","preventionTips":["Run servers on hosts with healthy entropy (modern kernels with getrandom).","Avoid seccomp/AppArmor profiles that block getrandom(2) or /dev/urandom access.","Monitor for crypto/rand errors at the host level."],"tags":["cryptography","entropy","key-wrapping"],"backgroundTag":"random-bytes-generation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}