Netflix/chaosmonkey · error

unsupported decryptor

Error message

unsupported decryptor: %s

What it means

getNullDecryptor() returns a no-op decryptor only when no decryptor kind is configured. If a Decryptor kind IS configured, the null decryptor path cannot support it, so this error is thrown (only the KMS decryptor path supports real kinds).

Solutions

1. Set decryptor to an empty string if no encryption is desired
2. Use a deployment/build with KMS decryptor support if a real decryptor is required
3. Check the decryptor config key spelling and allowed values

Example fix

// before
decryptor = "kms"  # in a build without KMS support
// after
decryptor = ""     # use null decryptor

if kind := cfg.Decryptor(); kind != "" && !kmsSupported {
    log.Printf("warning: decryptor=%q requested but KMS support unavailable; unsetting", kind)
}
// or require an empty decryptor when KMS is unavailable

dec, err := getDecryptor(cfg)
if err != nil {
    if strings.Contains(err.Error(), "unsupported decryptor") {
        log.Printf("falling back to null decryptor: %v", err)
        dec = nullDecryptor{}
    } else {
        return err
    }
}

When it happens

Trigger: Setting a decryptor value in config (e.g. decryptor = "kms") while the code path builds the null decryptor because KMS support isn't available/initialized in this setup.

Common situations: Config copied from a KMS-enabled deployment into a build without KMS support, typo'd decryptor name, misunderstanding that "" means null decryptor.

Related errors

• is not in cron range(0-23)
• deploySchedule: could not retrieve local timezone
• failed to parse config
• failed to populate schedule
• failed to read config file

AI-assisted analysis of Netflix/chaosmonkey@eaa28fb761 (2026-09-03). Data as JSON: /api/errors/bc4e37b83ab61537. Report an issue: GitHub.

Appendix: source

Thrown at decryptor/decryptor.go:39

	"github.com/pkg/errors"
)

type nullDecryptor struct{}

// Decrypt implements chaosmonkey.Decryptor.Decrypt
// This is a no-op implementation that simply returns the plaintext
func (n nullDecryptor) Decrypt(ciphertext string) (string, error) {
	return ciphertext, nil
}

func init() {
	deps.GetDecryptor = getNullDecryptor
}

func getNullDecryptor(cfg *config.Monkey) (chaosmonkey.Decryptor, error) {
	kind := cfg.Decryptor()
	if kind != "" {
		return nil, errors.Errorf("unsupported decryptor: %s", kind)
	}

	return nullDecryptor{}, nil
}

View on GitHub (pinned to eaa28fb761)