Netflix/chaosmonkey · error

unsupported decryptor: %s

Error message

unsupported decryptor: %s

What it means

getNullDecryptor() returns a no-op decryptor only when no decryptor kind is configured. If a Decryptor kind IS configured, the null decryptor path cannot support it, so this error is thrown (only the KMS decryptor path supports real kinds).

Source

Thrown at decryptor/decryptor.go:39

	"github.com/pkg/errors"
)

type nullDecryptor struct{}

// Decrypt implements chaosmonkey.Decryptor.Decrypt
// This is a no-op implementation that simply returns the plaintext
func (n nullDecryptor) Decrypt(ciphertext string) (string, error) {
	return ciphertext, nil
}

func init() {
	deps.GetDecryptor = getNullDecryptor
}

func getNullDecryptor(cfg *config.Monkey) (chaosmonkey.Decryptor, error) {
	kind := cfg.Decryptor()
	if kind != "" {
		return nil, errors.Errorf("unsupported decryptor: %s", kind)
	}

	return nullDecryptor{}, nil
}

View on GitHub (pinned to eaa28fb761)

Solutions

1. Set decryptor to an empty string if no encryption is desired
2. Use a deployment/build with KMS decryptor support if a real decryptor is required
3. Check the decryptor config key spelling and allowed values

Example fix

// before
decryptor = "kms"  # in a build without KMS support
// after
decryptor = ""     # use null decryptor

if kind := cfg.Decryptor(); kind != "" && !kmsSupported {
    log.Printf("warning: decryptor=%q requested but KMS support unavailable; unsetting", kind)
}
// or require an empty decryptor when KMS is unavailable

dec, err := getDecryptor(cfg)
if err != nil {
    if strings.Contains(err.Error(), "unsupported decryptor") {
        log.Printf("falling back to null decryptor: %v", err)
        dec = nullDecryptor{}
    } else {
        return err
    }
}

When it happens

Trigger: Setting a decryptor value in config (e.g. decryptor = "kms") while the code path builds the null decryptor because KMS support isn't available/initialized in this setup.

Common situations: Config copied from a KMS-enabled deployment into a build without KMS support, typo'd decryptor name, misunderstanding that "" means null decryptor.

Related errors

• FATAL: no spinnaker endpoint specified in config
• failed to populate schedule: %v
• deploySchedule: could not retrieve local timezone: %v
• failed to read config file
• failed to parse config

AI-assisted analysis of Netflix/chaosmonkey@eaa28fb761 (2026-09-03). Data as JSON: /api/errors/bc4e37b83ab61537. Report an issue: GitHub.