{"record":{"id":"36eb7ba1d9f2bdb8","repo":"cube-js/cube","slug":"unable-to-resolve-file-value-from-key","errorCode":null,"errorMessage":"Unable to resolve file \"${value}\" from ${key}","messagePattern":"Unable to resolve file \"(.+?)\" from (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/cubejs-backend-cloud/src/config.ts","lineNumber":64,"sourceCode":"      const env = dotenv.config({ path: envFile, multiline: 'line-breaks' }).parsed;\n      if (env) {\n        if ('CUBEJS_DEV_MODE' in env) {\n          delete env.CUBEJS_DEV_MODE;\n        }\n\n        const resolvePossibleFiles = [\n          'CUBEJS_DB_SSL_CA',\n          'CUBEJS_DB_SSL_CERT',\n          'CUBEJS_DB_SSL_KEY',\n        ];\n\n        // eslint-disable-next-line no-restricted-syntax\n        for (const [key, value] of Object.entries(env)) {\n          if (resolvePossibleFiles.includes(key) && isFilePath(value)) {\n            if (fs.existsSync(value)) {\n              env[key] = fs.readFileSync(value, 'ascii');\n            } else {\n              console.warn(`Unable to resolve file \"${value}\" from ${key}`);\n\n              env[key] = '';\n            }\n          }\n        }\n\n        return env;\n      }\n    }\n\n    return {};\n  }\n\n  public async addAuthToken(authToken: string, config?: Configuration): Promise<ConfigurationFull> {\n    if (!config) {\n      config = await this.loadConfig();\n    }\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-backend-cloud/src/config.ts#L46-L82","documentation":"Cube reads certain env vars (e.g. CUBEJS_DB_KEY_PATH, SSL cert vars) as paths to files whose contents should be inlined. When the env var is listed as a file-resolvable key, looks like a path, but no file exists at that path, Cube logs this warning, clears the value, and continues with an empty string instead of the file content.","triggerScenarios":"An env var such as CUBEJS_DB_KEY or CUBEJS_DB_CERT is set to a file path; fs.existsSync(path) returns false at startup, so the warn branch in envFile fires.","commonSituations":"Container images where the secret/cert file was not mounted or was mounted at a different path; typos in the path; working directory differences making relative paths invalid; Kubernetes secrets not mounted before Cube starts.","solutions":["Create/mount the file at the exact path given in the env var and restart Cube","Use an absolute path in the env var to avoid relative-path resolution issues","If the value is actual inline content, move it out of the file-resolvable env var keys (or change the key so it is not treated as a path)","Verify the volume/secret is mounted in the container before the Cube process starts"],"exampleFix":"// before\nCUBEJS_DB_KEY=/secrets/db.key   (file not mounted)\n// after\nCUBEJS_DB_KEY=/etc/cube/secrets/db.key   (mount: k8s secret at /etc/cube/secrets/)","handlingStrategy":"validation","validationCode":"const p = process.env.CUBEJS_DB_KEY;\nif (p && !fs.existsSync(p)) {\n  throw new Error(`File for CUBEJS_DB_KEY does not exist: ${p}`);\n}","typeGuard":"function isFilePath(v: unknown): v is string {\n  return typeof v === 'string' && (v.startsWith('/') || v.startsWith('./'));\n}","tryCatchPattern":null,"preventionTips":["Mount secret files before the app starts (init containers/entrypoint order)","Use absolute paths for file-like env vars","Validate required files exist in a startup health check","Keep inline secrets and file-path secrets in distinct env vars"],"tags":["filesystem","config","env","ssl"],"backgroundTag":"env-file-not-found","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}