argoproj/argo-workflows · error

failed to generate key: %w

Error message

failed to generate key: %w

What it means

newSso generates the cookie-encryption RSA key with crypto/rsa GenerateKey(rand.Reader, 2048). If the crypto/rand reader fails, the error is wrapped with this message. This is extremely rare — it means the OS entropy source failed.

Source

Thrown at server/auth/sso/sso.go:182

	}
	var logoutURL string
	if claimsErr := provider.Claims(&providerMetadata); claimsErr == nil {
		logoutURL = providerMetadata.EndSessionEndpoint
	} else {
		logging.RequireLoggerFromContext(ctx).WithError(claimsErr).Warn(ctx, "Failed to read OIDC provider metadata; provider logout disabled")
	}
	var clientIDObj *apiv1.Secret
	if c.ClientID.Name == c.ClientSecret.Name {
		clientIDObj = clientSecretObj
	} else {
		clientIDObj, err = secretsIf.Get(ctx, c.ClientID.Name, metav1.GetOptions{})
		if err != nil {
			return nil, err
		}
	}
	generatedKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("failed to generate key: %w", err)
	}
	// whoa - are you ignoring errors - yes - we don't care if it fails -
	// if it fails, then the get will fail, and the pod restart
	// it may fail due to race condition with another pod - which is fine,
	// when it restart it'll get the new key
	_, err = secretsIf.Create(ctx, &apiv1.Secret{
		ObjectMeta: metav1.ObjectMeta{Name: secretName},
		Data:       map[string][]byte{cookieEncryptionPrivateKeySecretKey: x509.MarshalPKCS1PrivateKey(generatedKey)},
	}, metav1.CreateOptions{})
	isSecretAlreadyExists := false
	if err != nil {
		isSecretAlreadyExists = apierr.IsAlreadyExists(err)
		if !isSecretAlreadyExists {
			return nil, fmt.Errorf("failed to create secret: %w", err)
		}
	}
	secret, err := secretsIf.Get(ctx, secretName, metav1.GetOptions{})
	if err != nil {

View on GitHub (pinned to 35bff19146)

Solutions

1. Inspect the wrapped error returned by rsa.GenerateKey for the OS-level cause
2. Verify /dev/urandom works in the argo-server container (od -An -N8 -tx1 /dev/urandom)
3. Restart the pod — this is a transient environment failure, not a config problem
4. Check kernel/seccomp settings that may block getrandom

_, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure)
if err != nil && strings.Contains(err.Error(), "failed to generate key") {
    // transient OS entropy failure: restart via normal pod retry
    return fmt.Errorf("transient RNG failure, pod will restart: %w", err)
}

When it happens

Trigger: rsa.GenerateKey returning a non-nil error during New() at argo-server startup, which in practice only happens when the OS CSPRNG (getrandom/urandom) is unavailable or returns an error.

Common situations: Running in a sandbox/container with a broken or blocked /dev/urandom or getrandom syscall; heavily degraded host entropy; exotic hardened kernels blocking getrandom.

Related errors

• failed to generate serial number: %w
• failed to create JWT encrypter: %w
• failed to create certificate: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/94d1ebeb7f64a2bf. Report an issue: GitHub.