hashicorp/nomad · error

keyring cannot be prepublished and full rotated at the same

Error message

keyring cannot be prepublished and full rotated at the same time

What it means

The keyring rotate RPC creates a new root encryption key for vars/keyring operations. A rotation can either be a 'full' rotation (re-encrypt all existing data with the new key immediately) or a pre-publication (set a future PublishTime so the key becomes active later) — but not both, since a key that is already fully active cannot also be staged for future publication.

Source

Thrown at nomad/keyring_endpoint.go:56

		return err
	}
	k.srv.MeasureRPCRate("keyring", structs.RateMetricWrite, args)
	if authErr != nil {
		return structs.ErrPermissionDenied
	}
	defer metrics.MeasureSince([]string{"nomad", "keyring", "rotate"}, time.Now())

	if aclObj, err := k.srv.ResolveACL(args); err != nil {
		return err
	} else if !aclObj.AllowOperatorOperation(acl.OperatorCapabilityKeyringRotate) {
		return structs.ErrPermissionDenied
	}

	if args.Algorithm == "" {
		args.Algorithm = structs.EncryptionAlgorithmAES256GCM
	}
	if args.Full && args.PublishTime > 0 {
		return fmt.Errorf("keyring cannot be prepublished and full rotated at the same time")
	}

	unwrappedKey, err := structs.NewUnwrappedRootKey(args.Algorithm)
	if err != nil {
		return err
	}

	if args.PublishTime != 0 {
		unwrappedKey.Meta.State = structs.RootKeyStatePrepublished
		unwrappedKey.Meta.PublishTime = args.PublishTime
	} else {
		unwrappedKey.Meta.State = structs.RootKeyStateActive
	}

	isClusterUpgraded := k.srv.peersCache.ServersMeetMinimumVersion(
		k.srv.Region(), minVersionKeyringInRaft, true)

	// wrap/encrypt the key before we write it to Raft

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Drop the -publish-time flag to perform an immediate full rotation
2. Drop the -full flag to stage the key with a publish time instead
3. Split operations: pre-publish now, then run a separate rotation when it should take effect

Example fix

// before
nomad keyring rotate -full -publish-time=1735689600
// after
nomad keyring rotate -full
// or
nomad keyring rotate -publish-time=1735689600

// before calling rotate
if full && publishTime != 0 {
  return fmt.Errorf("-full and -publish-time are mutually exclusive")
}

When it happens

Trigger: Calling the keyring Rotate API / nomad keyring rotate with both -full and -publish-time (non-zero PublishTime) set. Raised at the start of Rotate before generating the new key.

Common situations: Operator runs 'nomad keyring rotate -full -publish-time=...' combining flags that are mutually exclusive; automation scripts merging rotation options; misunderstanding that pre-publishing implies eventual full rotation.

Related errors

• A template must be supplied using '-template' when using go-
• Invalid value for "-out"; valid values are [go-template, hcl
• Error listing host volumes
• -node or -node-pool options can only be used when no ID is p
• unable to decrypt wrapped key

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/b19a4603332f4297. Report an issue: GitHub.