From 643ba6be2dae7efc9c02232a4af2050aa2bc35e6 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 4 Jul 2026 10:55:24 +0000 Subject: [PATCH] fleet-manager: actionable error when the enrol key is missing at startup Flipping FLEET_MGR_ADMIN_INSECURE=false before bootstrapping an admin crash-looped on a cryptic "enrol key: open /data/enroll.key: no such file or directory". The key is created by `register-admin`, so on ErrNotExist say exactly that (and note the insecure escape hatch) instead of surfacing the raw errno. --- serving/fleet-manager/cli.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/serving/fleet-manager/cli.go b/serving/fleet-manager/cli.go index e4c1e55..b2f4d1e 100644 --- a/serving/fleet-manager/cli.go +++ b/serving/fleet-manager/cli.go @@ -18,6 +18,7 @@ import ( "crypto/subtle" "encoding/base64" "encoding/hex" + "errors" "flag" "fmt" "os" @@ -87,6 +88,11 @@ func loadEnrollKey(path string) ([]byte, error) { return nil, fmt.Errorf("no enrol key file configured (FLEET_MGR_ENROLL_KEY_FILE)") } b, err := os.ReadFile(path) + if errors.Is(err, os.ErrNotExist) { + // The key is created by the admin bootstrap — a fresh secure-mode start + // before any admin exists lands here. Point at the fix, not the errno. + return nil, fmt.Errorf("enrol key %s not found — bootstrap the admin plane first: `fleet-manager register-admin ` (or set FLEET_MGR_ADMIN_INSECURE=true for dev)", path) + } if err != nil { return nil, err }