hashicorp/nomad · critical

failed to generate root key: %w

Error message

failed to generate root key: %w

What it means

NewUnwrappedRootKey generates a 32-byte AES-256 key for the root keyring entry using crypto.Bytes; if entropy generation fails the key cannot be created and the underlying error is wrapped with this message.

Source

Thrown at nomad/structs/keyring.go:67

	// RS256 algorithm. It is stored in its PKCS #1, ASN.1 DER form. See
	// x509.MarshalPKCS1PrivateKey for details.
	RSAKey []byte
}

// NewUnwrappedRootKey returns a new root key and its metadata.
func NewUnwrappedRootKey(algorithm EncryptionAlgorithm) (*UnwrappedRootKey, error) {
	meta := NewRootKeyMeta()
	meta.Algorithm = algorithm

	rootKey := &UnwrappedRootKey{
		Meta: meta,
	}

	switch algorithm {
	case EncryptionAlgorithmAES256GCM:
		key, err := crypto.Bytes(32)
		if err != nil {
			return nil, fmt.Errorf("failed to generate root key: %w", err)
		}
		rootKey.Key = key
	}

	// Generate RSA key for signing workload identity JWTs with RS256.
	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %w", err)
	}

	rootKey.RSAKey = x509.MarshalPKCS1PrivateKey(rsaPrivateKey)

	return rootKey, nil
}

func (k *UnwrappedRootKey) Copy() *UnwrappedRootKey {
	return &UnwrappedRootKey{
		Meta:   k.Meta.Copy(),

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Fix the underlying entropy source (ensure getrandom syscall is permitted in the container/seccomp profile)
2. Restart the node or process so entropy is re-initialized
3. Upgrade the Go runtime/kernel if entropy-related bugs are implicated

// pre-check entropy availability
tmp := make([]byte, 32)
if _, err := crand.Read(tmp); err != nil {
  return fmt.Errorf("entropy unavailable: %w", err)
}

rootKey, err := structs.NewUnwrappedRootKey(alg)
if err != nil && strings.Contains(err.Error(), "failed to generate root key") {
  // inspect wrapped cause: fix entropy source, then retry
}

When it happens

Trigger: Creating a root key (NewUnwrappedRootKey) with EncryptionAlgorithmAES256GCM when crypto.Bytes(32) returns an error, typically from the OS entropy source (getrandom/read of /dev/urandom) failing.

Common situations: Kernel entropy exhaustion or getrandom blocking/failing in containers; seccomp/AppArmor policies blocking getrandom syscall; heavily restricted CI sandboxes.

Related errors

• failed to generate rsa key: %w
• unable to decrypt wrapped key
• root key not found
• root key in use, cannot delete
• failed to configure keyring: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5f5c496aad215b7e. Report an issue: GitHub.