{"record":{"id":"1f07f3b28ab354eb","repo":"risingwavelabs/risingwave","slug":"no-auth-method-specified-for-vault-backend","errorCode":null,"errorMessage":"No auth method specified for Vault backend","messagePattern":"No auth method specified for Vault backend","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/common/secret/src/vault_client.rs","lineNumber":124,"sourceCode":"}\n\nimpl HashiCorpVaultConfig {\n    /// Convert from protobuf `SecretHashicorpVaultBackend` to `HashiCorpVaultConfig`\n    pub fn from_protobuf(vault_backend: &secret::SecretHashicorpVaultBackend) -> Result<Self> {\n        let auth = match vault_backend.auth.as_ref() {\n            Some(secret::secret_hashicorp_vault_backend::Auth::TokenAuth(token_auth)) => {\n                HashiCorpVaultAuth::Token {\n                    auth_token: token_auth.token.clone(),\n                }\n            }\n            Some(secret::secret_hashicorp_vault_backend::Auth::ApproleAuth(approle_auth)) => {\n                HashiCorpVaultAuth::AppRole {\n                    auth_role_id: approle_auth.role_id.clone(),\n                    auth_secret_id: approle_auth.secret_id.clone(),\n                }\n            }\n            None => {\n                return Err(anyhow::anyhow!(\n                    \"No auth method specified for Vault backend\"\n                ));\n            }\n        };\n\n        Ok(HashiCorpVaultConfig {\n            addr: vault_backend.addr.clone(),\n            path: vault_backend.path.clone(),\n            field: vault_backend.field.clone(),\n            auth,\n            tls_skip_verify: vault_backend.tls_skip_verify,\n        })\n    }\n\n    /// Convert `HashiCorpVaultConfig` to protobuf `SecretHashicorpVaultBackend`\n    pub fn to_protobuf(&self) -> secret::SecretHashicorpVaultBackend {\n        let auth = match &self.auth {\n            HashiCorpVaultAuth::Token { auth_token } => Some(","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/vault_client.rs#L106-L142","documentation":"HashiCorpVaultConfig::from_protobuf requires an authentication method to construct a usable Vault client configuration. When the protobuf secret definition carries no auth payload (neither AppRole nor any other auth variant), the builder cannot produce credentials and aborts with this error. Vault always requires some auth mechanism, so a config without one is unusable.","triggerScenarios":"Calling from_protobuf on a secret proto whose auth field is None — e.g. a CREATE SECRET with HashiCorp Vault backend but no approle_auth (or other auth) clause specified.","commonSituations":"User creates a Vault-backed secret but omits the authentication clause; a migration or tooling script strips the auth field from the protobuf; older client versions that did not populate the auth message.","solutions":["Add the Vault authentication configuration (e.g. APPROLE with role_id and secret_id) to the CREATE SECRET statement and retry","Inspect the protobuf payload being passed to from_protobuf and confirm the auth oneof is populated","Check client/tooling version to ensure it emits the auth field in the secret proto"],"exampleFix":"// before\nCREATE SECRET s1 WITH (backend='hashicorp_vault', url='https://vault:8200');\n// after\nCREATE SECRET s1 WITH (backend='hashicorp_vault', url='https://vault:8200', approle_auth='{\"role_id\":\"xxx\",\"secret_id\":\"yyy\"}');","handlingStrategy":"validation","validationCode":"fn validate_vault_config(proto: &SecretProto) -> Result<(), String> {\n    if proto.auth.is_none() {\n        return Err(\"Vault backend requires an auth method (e.g. approle_auth with role_id and secret_id)\".into());\n    }\n    Ok(())\n}","typeGuard":"let auth = match &proto.auth { Some(a) => a, None => return Err(...) };","tryCatchPattern":null,"preventionTips":["Always include the auth clause when creating HashiCorp Vault-backed secrets","Validate secret definitions with a schema check before submitting them","Pin client tooling versions that emit the full auth proto"],"tags":["vault","authentication","config"],"backgroundTag":"missing-required-config-field","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}