hashicorp/nomad · error

variable error: encrypt: %w

Error message

variable error: encrypt: %w

What it means

For set/CAS/lock-acquire/lock-release operations, Apply encrypts the variable via sv.encrypt, which uses the cluster keyring. If encryption fails (keyring absent, no key material, keyring service error), the error is wrapped as 'variable error: encrypt: %w'. This indicates a keyring/encryption subsystem problem rather than a bad request.

Source

Thrown at nomad/variables_endpoint.go:115

	}
	err = hasOperationPermissions(aclObj, args.Var.Namespace, args.Var.Path, args.Op)
	if err != nil {
		return err
	}

	err = canonicalizeAndValidate(args)
	if err != nil {
		return structs.NewErrRPCCoded(http.StatusBadRequest, err.Error())
	}

	var ev *structs.VariableEncrypted

	switch args.Op {
	case structs.VarOpSet, structs.VarOpCAS, structs.VarOpLockAcquire,
		structs.VarOpLockRelease:
		ev, err = sv.encrypt(args.Var)
		if err != nil {
			return fmt.Errorf("variable error: encrypt: %w", err)
		}
		now := time.Now().UnixNano()
		ev.CreateTime = now // existing will override if it exists
		ev.ModifyTime = now

	case structs.VarOpDelete, structs.VarOpDeleteCAS:
		ev = &structs.VariableEncrypted{
			VariableMetadata: structs.VariableMetadata{
				Namespace:   args.Var.Namespace,
				Path:        args.Var.Path,
				ModifyIndex: args.Var.ModifyIndex,
			},
		}
	}

	// Make a SVEArgs
	sveArgs := structs.VarApplyStateRequest{
		Op:           args.Op,

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check server logs for the underlying keyring error from the encrypt call
2. Ensure the keyring is initialized (`nomad operator keyring` / keyring API) on all servers
3. Restore/rotate keyring keys if keys were lost or removed
4. Verify all servers meet the minimum keyring version (see related version gate)

// probe keyring availability before writing
_, err := client.Agent().MakeHTTPClient().Get("/v1/operator/keyring/keys")
// non-200/absent keyring -> surface a clear error before Apply

_, err := client.Variables().Apply(req, nil)
if err != nil && strings.Contains(err.Error(), "variable error: encrypt") {
    // inspect root cause via errors.Unwrap; check keyring state; do not blind-retry
}

When it happens

Trigger: Calling Variables Apply with VarOpSet/VarOpCAS/VarOpLockAcquire/VarOpLockRelease when the keyring is not initialized or unreachable — e.g. keyring lost after restoring an old Raft state, or the version gate was bypassed.

Common situations: Cluster restored from backup without keyring metadata; keyring encryption keys revoked/rotated incorrectly; mixed-version clusters partially supporting keyrings; operator deleted keyring keys.

Related errors

• unable to decrypt wrapped key
• root key not found
• root key in use, cannot delete
• failed to configure keyring: %v
• failed to get active nomad key: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/09d0c7b23255f2af. Report an issue: GitHub.