cilium/cilium · critical

failed to generate wg private key: %w

Error message

failed to generate wg private key: %w

What it means

loadOrGeneratePrivKey reads the agent's WireGuard private key from disk; if the file does not exist, it generates a new private key with wgtypes.GeneratePrivateKey. Failure of curve25519 key generation (cryptographically near-impossible; indicates RNG/environmental failure) is wrapped here. Called during agent init, so it aborts WireGuard setup.

Source

Thrown at pkg/wireguard/agent/agent.go:797

		)

		if err := a.deletePeerByPubKey(wgDummyPeerKey); err != nil {
			return fmt.Errorf("while deleting dummy peer: %w", err)
		}
	}

	p.finishAllowedIPSync(addedIPs)
	p.finishAllowedIPSync(removedIPs)

	return nil
}

func loadOrGeneratePrivKey(filePath string) (key wgtypes.Key, err error) {
	bytes, err := os.ReadFile(filePath)
	if os.IsNotExist(err) {
		key, err = wgtypes.GeneratePrivateKey()
		if err != nil {
			return wgtypes.Key{}, fmt.Errorf("failed to generate wg private key: %w", err)
		}

		err = os.WriteFile(filePath, key[:], 0600)
		if err != nil {
			return wgtypes.Key{}, fmt.Errorf("failed to save wg private key: %w", err)
		}

		return key, nil
	} else if err != nil {
		return wgtypes.Key{}, fmt.Errorf("failed to load wg private key: %w", err)
	}

	return wgtypes.NewKey(bytes)
}

// OnIPIdentityCacheChange implements ipcache.IPIdentityMappingListener
func (a *Agent) OnIPIdentityCacheChange(modType ipcache.CacheModification, cidrCluster cmtypes.PrefixCluster, oldHostIP, newHostIP net.IP,
	_ *ipcache.Identity, _ ipcache.Identity, _ uint8, _ *ipcache.K8sMetadata, _ uint8) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify /dev/urandom is accessible and getrandom(2) is not blocked by the seccomp/apparmor profile
2. Fix the container runtime security profile to allow crypto/rand syscalls
3. Ensure the key file directory is writable (also avoids the sibling 'failed to save wg private key')
4. Restart the node/agent and retry — this failure is almost always transient/environmental

Example fix

// before (docker run blocking getrandom)
docker run --security-opt seccomp:custom.json ...
// after
// allow getrandom in the profile, or:
docker run --cap-add NET_ADMIN --security-opt seccomp:default ...

f, err := os.OpenFile("/dev/urandom", os.O_RDONLY, 0)
if err != nil {
    return fmt.Errorf("entropy source unavailable: %w", err)
}
f.Close()

key, err := loadOrGeneratePrivKey(path)
if err != nil {
    return fmt.Errorf("cannot bootstrap wireguard identity: %w", err)
    // abort init; alert operator — do not run without a node key
}

When it happens

Trigger: First-time agent start (no key file) where wgtypes.GeneratePrivateKey returns an error from the underlying randomness source (crypto/rand failure).

Common situations: Degraded /dev/urandom or entropy issues in minimal containers/seccomp profiles blocking getrandom, running on unusual sandboxed environments.

Related errors

• failed to create IPsec key: %w
• failed to generate authentication key: %w
• failed to generate symmetric encryption key: %w
• %w: both agent and kernel states are empty
• %w: agent state is empty

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/1cac0b44e0e40980. Report an issue: GitHub.