What causes "failed to generate key wrapper key: %w" in hashicorp/nomad?

Inspect the wrapped underlying error for the crypto/rand failure cause and fix the host entropy source.

failed to generate key wrapper key: %w

Error message

failed to generate key wrapper key: %w

What it means

During encryptDEK, when the KEK provider is AEAD (or unspecified), a random 32-byte key-encryption key is generated with crypto.Bytes(32). If that entropy read fails, the code wraps the error as "failed to generate key wrapper key". Without a KEK, the root key cannot be wrapped, so key creation is aborted.

Source

Thrown at nomad/encrypter.go:865

		wrappedKeys.WrappedKeys = append(wrappedKeys.WrappedKeys, wrappedKey)

	}
	return wrappedKeys, nil
}

// encryptDEK encrypts the DEKs (one for encryption and one for signing) with
// the KMS provider and returns a WrappedKey built from the provider's
// kms.BlobInfo. This includes the cleartext KEK for the AEAD provider.
func (e *Encrypter) encryptDEK(rootKey *structs.UnwrappedRootKey, provider *structs.KEKProviderConfig) (*structs.WrappedKey, error) {
	if provider == nil {
		panic("can't encrypt DEK without a provider")
	}
	var kek []byte
	var err error
	if provider.Provider == structs.KEKProviderAEAD || provider.Provider == "" {
		kek, err = crypto.Bytes(32)
		if err != nil {
			return nil, fmt.Errorf("failed to generate key wrapper key: %w", err)
		}
	}
	wrapper, err := e.newKMSWrapper(provider, rootKey.Meta.KeyID, kek)
	if err != nil {
		return nil, fmt.Errorf("unable to create key wrapper: %w", err)
	}

	rootBlob, err := wrapper.Encrypt(e.srv.shutdownCtx, rootKey.Key)
	if err != nil {
		return nil, fmt.Errorf("failed to encrypt root key: %w", err)
	}

	kekWrapper := &structs.WrappedKey{
		Provider:                 provider.Provider.String(),
		ProviderID:               provider.ID(),
		WrappedDataEncryptionKey: rootBlob,
		WrappedRSAKey:            &kms.BlobInfo{},
		KeyEncryptionKey:         kek,

View on GitHub (pinned to 482b49bf1a)

Solutions

Inspect the wrapped underlying error for the crypto/rand failure cause and fix the host entropy source.
Ensure /dev/urandom is available and getrandom(2) is not blocked by seccomp/AppArmor profiles in the container.
Retry the key rotation/creation operation once entropy is healthy.
Run on a kernel/platform with a working getrandom implementation (Linux 3.17+, modern Windows/macOS).

Defensive patterns

Strategy: retry

Try / catch

kek, err := encryptDEK(...)
if err != nil && strings.Contains(err.Error(), "failed to generate key wrapper key") {
    // transient RNG failure: retry after checking host entropy health
}

Prevention

Run servers on hosts with healthy entropy (modern kernels with getrandom).
Avoid seccomp/AppArmor profiles that block getrandom(2) or /dev/urandom access.
Monitor for crypto/rand errors at the host level.

When it happens

Trigger: crypto.Bytes(32) returns an error while encrypting a DEK/wrapping a root key for an AEAD-provider KEK wrapper — i.e., the CSPRNG-backed random byte generator failed.

Common situations: Degraded OS entropy sources on stripped-down containers or embedded hosts; failures in the crypto/rand reader under heavy startup load or restricted environments (e.g., seccomp blocking getrandom).

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/de96e6eb1877f2ff. Report an issue: GitHub.