hashicorp/nomad · error

Could not re-encode redacted key: %v

Error message

Could not re-encode redacted key: %v

What it means

Each redacted root key is re-encoded into a structs.WrappedRootKeysUpsertRequest message to be replayed into the FSM. This error wraps a failure of structs.Encode on that message. It indicates the in-memory key structure could not be msgpack/codec-encoded, i.e., the data read from the snapshot is structurally invalid for the encoder.

Source

Thrown at helper/raftutil/snapshot.go:85

	for {
		raw := iter.Next()
		if raw == nil {
			break
		}
		rootKey := raw.(*structs.RootKey)
		if rootKey == nil {
			break
		}
		if len(rootKey.WrappedKeys) > 0 {
			rootKey.KeyID = rootKey.KeyID + " [REDACTED]"
			rootKey.WrappedKeys = nil
		}
		msg, err := structs.Encode(structs.WrappedRootKeysUpsertRequestType,
			&structs.KeyringUpsertWrappedRootKeyRequest{
				WrappedRootKeys: rootKey,
			})
		if err != nil {
			return fmt.Errorf("Could not re-encode redacted key: %v", err)
		}

		fsm.Apply(&raft.Log{
			Type: raft.LogCommand,
			Data: msg,
		})
	}

	snap, err := snapshot.NewFromFSM(hclog.Default(), fsm, meta)
	if err != nil {
		return fmt.Errorf("Failed to create redacted snapshot: %v", err)
	}

	srcFile.Truncate(0)
	srcFile.Seek(0, 0)

	_, err = io.Copy(srcFile, snap)
	if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Rebuild/redact using a binary of the same version that produced the snapshot.
2. Inspect the embedded encode error to find the offending field and key; if a single key is corrupt, restore the snapshot to a test cluster and rotate the keyring instead.
3. Upgrade the tooling to a version whose structs.WrappedRootKeysUpsertRequestType codec matches the snapshot format.
4. Re-take the snapshot from the live cluster and retry.

if err := raftutil.RedactSnapshot(f); err != nil {
    if strings.Contains(err.Error(), "Could not re-encode redacted key") {
        log.Printf("keyring re-encode failed (likely version mismatch): %v", err)
    }
}

When it happens

Trigger: structs.Encode(structs.WrappedRootKeysUpsertRequestType, &structs.KeyringUpsertWrappedRootKeyRequest{...}) failing while iterating RootKeys — codec errors from unexpected field types in a decoded root key, nil/malformed key material, or a type/version mismatch between the decoded key and the current structs definitions.

Common situations: Cross-version redaction: snapshot written by a Consul version whose keyring struct differs from the tool's compiled structs, yielding keys that decode but cannot re-encode.

Related errors

• failed to open snapshot dir: %v
• Failed to load snapshot from archive: %w
• Failed to query for root keys: %v
• Failed to create redacted snapshot: %v
• Failed to copy snapshot to temporary file: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/3b72ba78435fea5b. Report an issue: GitHub.