hashicorp/nomad · error

failed to write secrets/%s: %w

Error message

failed to write secrets/%s: %w

What it means

Fires in copyCertificate while persisting a Consul TLS certificate into the allocation's secrets dir: the file was created and copied, but fd.Sync failed (typically a full disk or fs error), so the bytes may not be durable.

Source

Thrown at client/allocrunner/taskrunner/connect_native_hook.go:169

	original, err := os.Open(source)
	if err != nil {
		return fmt.Errorf("failed to open consul TLS certificate: %w", err)
	}
	defer original.Close()

	destination := filepath.Join(dir, name)
	fd, err := os.Create(destination)
	if err != nil {
		return fmt.Errorf("failed to create secrets/%s: %w", name, err)
	}
	defer fd.Close()

	if _, err := io.Copy(fd, original); err != nil {
		return fmt.Errorf("failed to copy certificate secrets/%s: %w", name, err)
	}

	if err := fd.Sync(); err != nil {
		return fmt.Errorf("failed to write secrets/%s: %w", name, err)
	}

	return nil
}

// tlsEnv creates a set of additional of environment variables to be used when launching
// the connect native task. This will enable the task to communicate with Consul
// if Consul has transport security turned on.
//
// We do NOT set CONSUL_HTTP_TOKEN from the nomad agent's consul config, as that
// is a separate security concern addressed by the service identity hook.
func (h *connectNativeHook) tlsEnv(env map[string]string) map[string]string {
	m := make(map[string]string)

	if _, exists := env["CONSUL_CACERT"]; !exists && h.consulConfig.CAFile != "" {
		m["CONSUL_CACERT"] = filepath.Join("/secrets", secretCAFilename)
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check disk health (I/O errors in dmesg) and free space
2. Verify filesystem supports fsync and is not failing
3. Restart the allocation to retry the certificate write

When it happens

Trigger: Thrown at client/allocrunner/taskrunner/connect_native_hook.go:169 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/d69a2bb8ed28601b. Report an issue: GitHub.