VictoriaMetrics/VictoriaMetrics · error

cannot parse auth config: %w

Error message

cannot parse auth config: %w

What it means

Azure SD wraps errors from HTTPClientConfig.NewConfig (parsing the auth section: bearer token, basic auth, OAuth2 client credentials, TLS settings) with 'cannot parse auth config'. The underlying error names the exact field (e.g. invalid client_secret_file path, bad TLS config).

Source

Thrown at lib/promscrape/discovery/azure/api.go:96

	v, err := configMap.Get(sdc, func() (any, error) { return newAPIConfig(sdc, baseDir) })
	if err != nil {
		return nil, err
	}
	return v.(*apiConfig), nil
}

func newAPIConfig(sdc *SDConfig, baseDir string) (*apiConfig, error) {
	if sdc.SubscriptionID == "" {
		return nil, fmt.Errorf("missing `subscription_id` config option")
	}
	port := sdc.Port
	if port == 0 {
		port = 80
	}

	ac, err := sdc.HTTPClientConfig.NewConfig(baseDir)
	if err != nil {
		return nil, fmt.Errorf("cannot parse auth config: %w", err)
	}
	proxyAC, err := sdc.ProxyClientConfig.NewConfig(baseDir)
	if err != nil {
		return nil, fmt.Errorf("cannot parse proxy auth config: %w", err)
	}

	environment := sdc.Environment
	if environment == "" {
		environment = "AZURECLOUD"
	}
	env, err := getCloudEnvByName(environment)
	if err != nil {
		return nil, fmt.Errorf("cannot read configs for `environment: %q`: %w", environment, err)
	}

	refreshToken, err := getRefreshTokenFunc(sdc, ac, proxyAC, env)
	if err != nil {
		return nil, err

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Read the wrapped error (%w) for the exact offending field and fix it in the azure_sd_config's http_client_config/auth section.
2. Verify all referenced *_file paths exist and are readable by the VictoriaMetrics process, remembering paths are resolved relative to the scrape config's directory.
3. Provide exactly one auth mechanism (client_id/client_secret for Azure, or bearer_token_file) and remove conflicting ones.
4. Validate the config upfront with -promscrape.configCheck or the /config web endpoint before reloading.

Example fix

# before
azure_sd_configs:
  - subscription_id: "..."
    http_client_config:
      oauth2:
        client_id: "..."
        client_secret_file: ./secrets/azure-secret   # file not found
# after
azure_sd_configs:
  - subscription_id: "..."
    client_id: "..."
    client_secret_file: /etc/vm/azure-secret   # absolute, existing path
    tenant_id: "..."

// Go: check auth files before handing the config to VM
func authFilesExist(secretFile string) error {
	if secretFile == "" {
		return nil
	}
	if _, err := os.Stat(secretFile); err != nil {
		return fmt.Errorf("client_secret_file %q unreadable: %w", secretFile, err)
	}
	return nil
}

if _, err := sdc.HTTPClientConfig.NewConfig(baseDir); err != nil {
	var pathErr *os.PathError
	if errors.As(err, &pathErr) {
		log.Fatalf("auth file missing for Azure SD: %v", pathErr)
	}
	return fmt.Errorf("cannot parse auth config: %w", err)
}

When it happens

Trigger: newAPIConfig calls sdc.HTTPClientConfig.NewConfig(baseDir); it fails when referenced files (client_secret_file, bearer_token_file, CA cert/key files) are missing/unreadable, or auth/oauth2/TLS fields are invalid or mutually inconsistent (e.g. both client_id+client_secret and bearer_token set).

Common situations: client_secret_file path wrong relative to -promscrape.config file's baseDir; file permissions deny read; mixing incompatible auth options; malformed tls_config cert paths.

Related errors

• cannot parse auth config for `job_name` %q: %w
• cannot parse auth config: %w
• cannot parse auth config: %w
• cannot parse auth config: %w
• cannot parse auth config: %w

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/522aee8937003ed4. Report an issue: GitHub.