What causes "generating idempotency key: %w" in grafana/k6?

Run in an environment where crypto/rand works (kernel >= 3.17, unblocked getrandom)

generating idempotency key: %w

Error message

generating idempotency key: %w

What it means

Client.StartLocalExecution (internal/cloudapi/provisioning/api.go:195) generates an 8-byte random K6-Idempotency-Key header via crypto/rand before calling the API. This error means the OS CSPRNG could not be read. On modern platforms crypto/rand essentially never fails; failure indicates a broken or restricted environment (kernel without getrandom(2), aggressive seccomp/sandbox).

Source

Thrown at internal/cloudapi/provisioning/api.go:195

		select {
		case <-ctx.Done():
			return ctx.Err()
		case <-time.After(pollInterval):
			// continue polling
		}
	}
}

// StartLocalExecution starts a local-execution test run via the
// provisioning API. It generates a K6-Idempotency-Key header for
// safe retries. The caller provides options as pre-marshalled JSON.
func (c *Client) StartLocalExecution(
	ctx context.Context, loadTestID int64, req StartLocalExecutionRequest,
) (*StartLocalExecutionResponse, error) {
	// Generate idempotency key: 8 random bytes hex-encoded (16 chars).
	var key [8]byte
	if _, err := rand.Read(key[:]); err != nil {
		return nil, fmt.Errorf("generating idempotency key: %w", err)
	}

	// SDK adapter: unmarshal json.RawMessage → map[string]any.
	var opts map[string]any
	if err := json.Unmarshal(req.Options, &opts); err != nil {
		return nil, fmt.Errorf("unmarshalling options for SDK: %w", err)
	}

	maxVUs, err := toInt32(req.MaxVUs)
	if err != nil {
		return nil, fmt.Errorf("max_vus: %w", err)
	}
	totalDuration, err := toInt32(req.TotalDuration)
	if err != nil {
		return nil, fmt.Errorf("total_duration: %w", err)
	}

	sdkReq := k6cloud.NewStartLocalExecutionTestRequest(opts, maxVUs, totalDuration)

View on GitHub (pinned to 93accf6570)

Solutions

Run in an environment where crypto/rand works (kernel >= 3.17, unblocked getrandom)
Inspect the container's seccomp profile and allow getrandom(2)
On old systems check /proc/sys/kernel/random/entropy_avail; the fix is environmental, not code-level
Retry the k6 run once entropy/services are confirmed healthy

Defensive patterns

Strategy: retry

Try / catch

if _, err := rand.Read(key[:]); err != nil {
	// environmental: verify getrandom availability, then retry once
	if _, err2 := rand.Read(key[:]); err2 != nil {
		return fmt.Errorf("CSPRNG unavailable: %w", err2)
	}
}

Prevention

Test containers/hosts for crypto/rand availability before deploying
Keep seccomp profiles permissive for getrandom(2)
Treat recurrence as an environment defect, not a code defect

When it happens

Trigger: rand.Read(key[:]) returns an error: pre-3.17 Linux kernel without getrandom, container seccomp profile blocking the syscall, or an exotic OS without a usable entropy source.

Common situations: Minimal Docker images with strict seccomp/AppArmor profiles; very old kernels or WSL1-era environments; embedded/virtualized hosts with blocked syscall surfaces.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/8390cccdd839d82f. Report an issue: GitHub.