hashicorp/nomad · critical

failed to generate root key

Error message

failed to generate root key: %w

What it means

NewUnwrappedRootKey generates a 32-byte AES-256 key for the root keyring entry using crypto.Bytes; if entropy generation fails the key cannot be created and the underlying error is wrapped with this message.

Solutions

1. Fix the underlying entropy source (ensure getrandom syscall is permitted in the container/seccomp profile)
2. Restart the node or process so entropy is re-initialized
3. Upgrade the Go runtime/kernel if entropy-related bugs are implicated

// pre-check entropy availability
tmp := make([]byte, 32)
if _, err := crand.Read(tmp); err != nil {
  return fmt.Errorf("entropy unavailable: %w", err)
}

rootKey, err := structs.NewUnwrappedRootKey(alg)
if err != nil && strings.Contains(err.Error(), "failed to generate root key") {
  // inspect wrapped cause: fix entropy source, then retry
}

When it happens

Trigger: Creating a root key (NewUnwrappedRootKey) with EncryptionAlgorithmAES256GCM when crypto.Bytes(32) returns an error, typically from the OS entropy source (getrandom/read of /dev/urandom) failing.

Common situations: Kernel entropy exhaustion or getrandom blocking/failing in containers; seccomp/AppArmor policies blocking getrandom syscall; heavily restricted CI sandboxes.

Related errors

• failed to generate rsa key
• active root key cannot be deleted - call rotate first
• cannot rekey without setting the new key active
• could not read from random source
• error parsing public key

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/5f5c496aad215b7e. Report an issue: GitHub.

Appendix: source

Thrown at nomad/structs/keyring.go:67

	// RS256 algorithm. It is stored in its PKCS #1, ASN.1 DER form. See
	// x509.MarshalPKCS1PrivateKey for details.
	RSAKey []byte
}

// NewUnwrappedRootKey returns a new root key and its metadata.
func NewUnwrappedRootKey(algorithm EncryptionAlgorithm) (*UnwrappedRootKey, error) {
	meta := NewRootKeyMeta()
	meta.Algorithm = algorithm

	rootKey := &UnwrappedRootKey{
		Meta: meta,
	}

	switch algorithm {
	case EncryptionAlgorithmAES256GCM:
		key, err := crypto.Bytes(32)
		if err != nil {
			return nil, fmt.Errorf("failed to generate root key: %w", err)
		}
		rootKey.Key = key
	}

	// Generate RSA key for signing workload identity JWTs with RS256.
	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %w", err)
	}

	rootKey.RSAKey = x509.MarshalPKCS1PrivateKey(rsaPrivateKey)

	return rootKey, nil
}

func (k *UnwrappedRootKey) Copy() *UnwrappedRootKey {
	return &UnwrappedRootKey{
		Meta:   k.Meta.Copy(),

View on GitHub (pinned to 482b49bf1a)