{"record":{"id":"f2234aa8961385a0","repo":"hashicorp/nomad","slug":"root-key-in-use-cannot-delete","errorCode":null,"errorMessage":"root key in use, cannot delete","messagePattern":"root key in use, cannot delete","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/keyring_endpoint.go","lineNumber":364,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\tif rootKey == nil {\n\t\treturn errors.New(\"root key not found\")\n\t}\n\n\tif rootKey != nil && rootKey.IsActive() {\n\t\treturn fmt.Errorf(\"active root key cannot be deleted - call rotate first\")\n\t}\n\n\t// make sure the key was used to encrypt an existing variable\n\trootKeyInUse, err := snap.IsRootKeyInUse(args.KeyID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif rootKeyInUse && !args.Force {\n\t\treturn errors.New(\"root key in use, cannot delete\")\n\t}\n\n\t_, index, err = k.srv.raftApply(structs.WrappedRootKeysDeleteRequestType, args)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// remove the key from the keyring too\n\tk.encrypter.RemoveKey(args.KeyID)\n\n\treply.Index = index\n\treturn nil\n}\n\n// ListPublic signing keys used for workload identities. This RPC is used to\n// back a JWKS endpoint.\n//\n// Unauthenticated because public keys are not sensitive.","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/keyring_endpoint.go#L346-L382","documentation":"A root key that has already encrypted variables cannot be deleted, because that would make the variables undecryptable. The keyring Delete endpoint returns this error when IsRootKeyInUse reports the key was used and the request did not set Force.","triggerScenarios":"Calling `nomad keyring remove` on a key that was used to encrypt existing variables without passing `-force`.","commonSituations":"Rotating variables keys and pruning old ones while old variables still exist; routine cleanup hitting keys referenced by live variables.","solutions":["Rewrite variables with a different key (or re-encrypt via rotation), then delete the key.","Pass `-force` (`nomad keyring remove -key-id <id> -force`) to delete anyway, acknowledging the affected variables cannot be decrypted.","Rotate the root key first so new data uses the new key, then force-delete the old one if acceptable."],"exampleFix":"// before\nnomad keyring remove -key-id abc123\n\n// after\nnomad keyring remove -key-id abc123 -force","handlingStrategy":"try-catch","validationCode":"// check usage before delete\ninUse, err := client.Variables().List(nil) // inspect which keys variables reference\n// or simply pass Force: true when old variables are expendable","typeGuard":null,"tryCatchPattern":"if _, err := k.Delete(args); err != nil && strings.Contains(err.Error(), \"root key in use\") {\n  // prompt user or set args.Force = true after acknowledging data loss\n  args.Force = true\n  return k.Delete(args)\n}","preventionTips":["Rotate keys and re-encrypt variables before deleting old keys","Use -force only after confirming affected variables are expendable","Track key usage via variables listing before cleanup"],"tags":["nomad","keyring","variables","conflict"],"backgroundTag":"resource-in-use","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}