hashicorp/nomad · error

%w (rsa key): %w

Error message

%w (rsa key): %w

What it means

While restoring the keyring, decryption of the wrapped RSA key (used for Workload Identity JWT signing since 1.7) failed. Unlike the DEK failure (2200), this is only logged, not returned — the cipherSet is created without an RSA private key, so JWT signing via RSA will be unavailable while ed25519 fallback may still work.

Source

Thrown at nomad/encrypter.go:596

			e.log.Error(err.Error(), "key_id", meta.KeyID)
			return err
		}
		return nil
	})
	if err != nil {
		return err
	}

	err = helper.WithBackoffFunc(ctx, minBackoff, maxBackoff, func() error {
		var err error

		// Decrypt RSAKey for Workload Identity JWT signing if one exists. Prior to
		// 1.7 an ed25519 key derived from the root key was used instead of an RSA
		// key.
		if wrappedKey.WrappedRSAKey != nil && len(wrappedKey.WrappedRSAKey.Ciphertext) > 0 {
			rsaKey, err = wrapper.Decrypt(e.srv.shutdownCtx, wrappedKey.WrappedRSAKey)
			if err != nil {
				err := fmt.Errorf("%w (rsa key): %w", ErrDecryptFailed, err)
				e.log.Error(err.Error(), "key_id", meta.KeyID)
			}
		}
		return nil
	})
	if err != nil {
		return err
	}

	rootKey := &structs.UnwrappedRootKey{
		Meta:   meta,
		Key:    key,
		RSAKey: rsaKey,
	}

	var generatedCipher *cipherSet

	err = helper.WithBackoffFunc(ctx, minBackoff, maxBackoff, func() error {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Inspect the agent log for the wrapped error to identify the KMS/crypto failure
2. Verify the external KMS credentials and that the key still decrypts
3. Trigger a keyring rotation to regenerate a valid wrapped RSA key under the current root key
4. Confirm nodes are on Nomad >= 1.7 if relying on RSA-based workload identity JWTs

Example fix

// no caller fix; operator remediation
// before: RSA key undecryptable -> workload identity JWT signing fails
// after: nomad keyring rotate  (regenerates RSA key under current root key)

// after startup, verify RSA signing capability instead of assuming
if _, err := encrypter.GetActiveKey(); err != nil { /* RSA/ed25519 keyring not ready */ }

func hasRSAKey(ks *cipherSet) bool { return ks != nil && ks.rsaPrivateKey != nil }

// failure is log-only; detect downstream JWT-signing failures and fall back
if err != nil { /* fall back to ed25519 signing or defer workload identity usage */ }

When it happens

Trigger: wrappedKey.WrappedRSAKey is non-empty but wrapper.Decrypt fails on it — mismatched root key material, corrupted ciphertext, or external KMS rejecting the operation.

Common situations: Clusters upgraded from pre-1.7 (ed25519-only) with partially written RSA key material; keyring snapshots restored from another cluster; KMS auth issues at agent startup.

Related errors

• failed to encrypt rsa key: %w
• unable to decrypt wrapped key
• could not encrypt: %w
• %w (root key): %w
• could not configure cipher: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/4e5ef1d57ae2cc1a. Report an issue: GitHub.