kubernetes/kops · error

error getting random data: %w

Error message

error getting random data: %w

What it means

runScript generates a unique remote temp directory name using crypto/rand (32 bytes, hex-encoded). If the CSPRNG read fails — essentially only on a broken system entropy source — this error is returned and the script is not staged.

Source

Thrown at pkg/commands/toolbox_enroll.go:354

}

func (s *SSHHost) readFile(ctx context.Context, path string) ([]byte, error) {
	p := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)

	return p.ReadFile(ctx)
}

func (s *SSHHost) writeFile(ctx context.Context, path string, data io.ReadSeeker) error {
	p := vfs.NewSSHPath(s.sshClient, s.hostname, path, s.sudo)
	return p.WriteFile(ctx, data, nil)
}

func (s *SSHHost) runScript(ctx context.Context, script string, options ExecOptions) (*CommandOutput, error) {
	var tempDir string
	{
		b := make([]byte, 32)
		if _, err := cryptorand.Read(b); err != nil {
			return nil, fmt.Errorf("error getting random data: %w", err)
		}
		tempDir = path.Join("/tmp", hex.EncodeToString(b))
	}

	scriptPath := path.Join(tempDir, "script.sh")

	p := vfs.NewSSHPath(s.sshClient, s.hostname, scriptPath, s.sudo)

	defer func() {
		if _, err := s.runCommand(ctx, "rm -rf "+tempDir, ExecOptions{Echo: false}); err != nil {
			klog.Warningf("error cleaning up temp directory %q: %v", tempDir, err)
		}
	}()

	if err := p.WriteFile(ctx, bytes.NewReader([]byte(script)), nil); err != nil {
		return nil, fmt.Errorf("error writing script to SSH target: %w", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check host entropy health: dmesg for random: crng init failures; upgrade kernel if affected
2. Rerun the command on a normal host/container without restrictive seccomp filters
3. Inspect the wrapped errno in the error for the syscall that failed
4. If in a container, relax seccomp to allow getrandom or run with --security-opt seccomp=unconfined to test

b := make([]byte, 32)
if _, err := cryptorand.Read(b); err != nil {
    return fmt.Errorf("system CSPRNG unavailable: %w", err)
}

host, err := NewSSHHost(...); _, err = sshHost.runScript(ctx, script, opts)
if err != nil && strings.Contains(err.Error(), "error getting random data") {
    return fmt.Errorf("host entropy broken; check dmesg for crng init failures")
}

When it happens

Trigger: cryptorand.Read(b) returns an error for the 32-byte buffer: getrandom(2) failing on the remote-local Go runtime, e.g. entropy initialization failure in constrained containers or kernel issues.

Common situations: Running kops inside a heavily restricted container/seccomp sandbox that blocks getrandom; early-boot environments where /dev/urandom and getrandom are unavailable; essentially never seen on normal hosts.

Related errors

• generating ecdsa key: %w
• error generating RSA private key: %v
• error generating Akamai (Linode) instance label for group %q
• error generating random label suffix: %w
• error creating secret %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c75c6cf0af9caabe. Report an issue: GitHub.