hashicorp/nomad · error

no such key

Error message

no such key

What it means

waitForKey polls the in-memory keyring for a cipherSet matching a key ID within the caller-provided context deadline. If the timeout expires or the key is never found, it returns "no such key". This means the key exists in state but the local agent's Encrypter never loaded it (or hasn't yet).

Source

Thrown at nomad/encrypter.go:721

func (e *Encrypter) waitForKey(ctx context.Context, keyID string) (*cipherSet, error) {
	var ks *cipherSet

	err := helper.WithBackoffFunc(ctx, 50*time.Millisecond, 100*time.Millisecond,
		func() error {
			e.keyringLock.RLock()
			defer e.keyringLock.RUnlock()
			var err error
			ks, err = e.cipherSetByIDLocked(keyID)
			if err != nil {
				return err
			}
			return nil
		})
	if err != nil {
		return nil, err
	}
	if ks == nil {
		return nil, fmt.Errorf("no such key")
	}
	return ks, nil
}

// GetActiveKey returns the active private key and its kid (key id)
func (e *Encrypter) GetActiveKey() (*rsa.PrivateKey, string, error) {
	c, err := e.activeCipherSet()
	if err != nil {
		return nil, "", err
	}
	return c.rsaPrivateKey, c.rootKey.Meta.KeyID, nil
}

// GetKey retrieves the key material by ID from the keyring.
func (e *Encrypter) GetKey(keyID string) (*structs.UnwrappedRootKey, error) {
	e.keyringLock.Lock()
	defer e.keyringLock.Unlock()

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Confirm the key ID via the keyring list API and check agent logs for addCipher/decrypt failures for that key
2. Wait for keyring replication or retry shortly after key rotation
3. Fix the underlying key-loading failure (KMS auth, bad key material) so the cipherSet gets added
4. Verify you're querying an agent/scheduler that is part of the same region/authority as the key

Example fix

// before: decrypt immediately after rotate with new key id on a lagging agent
// after: retry/poll until the keyring list shows the key on all agents, or use the active key id
ks, err := e.activeCipherSet() // use currently active key instead of unknown key id

// poll keyring list until the desired KeyID appears before calling decrypt
for i := 0; i < 10; i++ {
    if keyringHas(kid) { break } ; time.Sleep(500 * time.Millisecond)
}

if err != nil && err.Error() == "no such key" {
    // retry after replication delay, or fall back to the active key
}

When it happens

Trigger: Decrypt/activeCipherSet/waitForPublicKey called with a KeyID whose cipherSet is absent after the wait deadline — keyring replication lag, the agent failed to load that key (see errors 2200-2206), or the key ID is wrong.

Common situations: Workload signed with a key from before an agent joined/replicated; key decryption failures at load time on this agent; using a stale/incorrect key ID after rotation.

Related errors

• failed to wait for keyring decryption to complete: %v
• rcp.connection_write_timeout must be greater than zero
• rcp.stream_close_timeout must be greater than zero
• rcp.stream_open_timeout must be greater than zero
• unable to decrypt wrapped key

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/7660abdd0449bdfd. Report an issue: GitHub.