{"record":{"id":"138e842ed2c13c78","repo":"vitessio/vitess","slug":"failed-to-load-static-auth-plugin-plugin-configur","errorCode":null,"errorMessage":"failed to load static auth plugin. Plugin configured but grpc-auth-static-password-file not provided","messagePattern":"failed to load static auth plugin\\. Plugin configured but grpc-auth-static-password-file not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/servenv/grpc_server_auth_static.go","lineNumber":136,"sourceCode":"}\n\n// StaticAuthUsernameFromContext returns the username authenticated by the static auth plugin and stored in the Context, if any\nfunc StaticAuthUsernameFromContext(ctx context.Context) string {\n\tusername, ok := ctx.Value(staticAuthUsername).(string)\n\tif ok {\n\t\treturn username\n\t}\n\treturn \"\"\n}\n\nfunc newStaticAuthContext(ctx context.Context, username string) context.Context {\n\treturn context.WithValue(ctx, staticAuthUsername, username)\n}\n\nfunc staticAuthPluginInitializer() (Authenticator, error) {\n\tentries := make([]StaticAuthConfigEntry, 0)\n\tif credsFile == \"\" {\n\t\terr := errors.New(\"failed to load static auth plugin. Plugin configured but grpc-auth-static-password-file not provided\")\n\t\treturn nil, err\n\t}\n\n\tdata, err := os.ReadFile(credsFile)\n\tif err != nil {\n\t\terr := fmt.Errorf(\"failed to load static auth plugin %v\", err)\n\t\treturn nil, err\n\t}\n\n\terr = json.Unmarshal(data, &entries)\n\tif err != nil {\n\t\terr := fmt.Errorf(\"fail to load static auth plugin: %v\", err)\n\t\treturn nil, err\n\t}\n\tauthEntries := make([]staticAuthEntry, 0, len(entries))\n\tfor i, entry := range entries {\n\t\tauthEntry := staticAuthEntry{StaticAuthConfigEntry: entry}\n\t\tif entry.CachingSha2Password != \"\" {","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/servenv/grpc_server_auth_static.go#L118-L154","documentation":"servenv's static gRPC auth plugin is registered because static auth was configured, but the required credential file flag grpc-auth-static-password-file is empty, so no authenticator can be constructed. The plugin initializer deliberately fails fast rather than starting an insecure server that appears auth-enabled.","triggerScenarios":"Setting --grpc-auth-static (or otherwise registering the static plugin) without also supplying --grpc-auth-static-password-file; staticAuthPluginInitializer invoked at server startup with credsFile == \"\".","commonSituations":"Deployment configs enabling static auth but omitting the password-file flag; helm/env templating that drops the file path; the file flag applied to the wrong binary/process.","solutions":["Pass --grpc-auth-static-password-file /path/to/creds.json whenever static auth is enabled","Verify the flag reaches the vttablet/vtctld process (check config templates and process args)","Ensure the file exists and is readable by the process user (next failure would be a read error)"],"exampleFix":"// before\nvttablet --grpc-auth-static ... # no password file\n// after\nvttablet --grpc-auth-static --grpc-auth-static-password-file /etc/vitess/static_auth.json ...","handlingStrategy":"validation","validationCode":"if staticAuthEnabled && credsFile == \"\" {\n    return errors.New(\"static auth enabled but --grpc-auth-static-password-file is not set\")\n}\nif _, err := os.Stat(credsFile); err != nil {\n    return fmt.Errorf(\"static auth file unreadable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair the static-auth enable flag with --grpc-auth-static-password-file","Validate config templates render the password-file path","Check file existence and permissions in startup/health checks","Inspect process args in the deployment to confirm the flag landed"],"tags":["go","servenv","grpc","authentication","configuration"],"backgroundTag":"missing-config-file","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}