{"record":{"id":"465d82ff2f727ea4","repo":"risingwavelabs/risingwave","slug":"secret-not-found-0","errorCode":null,"errorMessage":"secret not found: {0}","messagePattern":"secret not found: (.+?)","errorType":"exception","errorClass":"SecretError","httpStatus":null,"severity":"error","filePath":"src/common/secret/src/error.rs","lineNumber":25,"sourceCode":"//     http://www.apache.org/licenses/LICENSE-2.0\n//\n// Unless required by applicable law or agreed to in writing, software\n// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\npub use anyhow::anyhow;\nuse thiserror::Error;\nuse thiserror_ext::Construct;\n\nuse super::SecretId;\n\npub type SecretResult<T> = Result<T, SecretError>;\n\n#[derive(Error, Debug, Construct)]\npub enum SecretError {\n    #[error(\"secret not found: {0}\")]\n    ItemNotFound(SecretId),\n\n    #[error(\"decode utf8 error: {0}\")]\n    DecodeUtf8Error(#[from] std::string::FromUtf8Error),\n\n    #[error(\"I/O error: {0}\")]\n    IoError(#[from] std::io::Error),\n\n    #[error(\"unspecified secret ref type: {0}\")]\n    UnspecifiedRefType(SecretId),\n\n    #[error(\"failed to encrypt or decrypt the secret\")]\n    AesError,\n\n    #[error(\"ser/de proto message error: {0}\")]\n    ProtoError(#[from] bincode::Error),\n\n    #[error(transparent)]","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/error.rs#L7-L43","documentation":"SecretError::ItemNotFound is raised when a secret is looked up by SecretId but no secret with that id exists in the secret manager / storage backend. Callers such as the secret handling code in meta/frontend convert this into an error surfaced to the SQL client when a referenced secret cannot be resolved.","triggerScenarios":"Calling the secret manager's get/fetch API with a SecretId that was never created, or whose underlying secret was dropped; resolving a `SECRET <name>` reference whose backing entry is missing at read time.","commonSituations":"A CREATE SECRET was never run (or ran against a different cluster/database); the secret was dropped by another session between creation of a dependent object and its use; typos or case sensitivity in the secret id/name; restoring into an environment where secrets were not carried over.","solutions":["Create the secret first with `CREATE SECRET <name> WITH (...)` before referencing it.","Verify the exact secret id/name (list existing secrets) and correct typos or case.","Re-create the secret if it was dropped, then retry the operation.","Check you are connected to the same cluster/database where the secret exists."],"exampleFix":"-- before\nSELECT * FROM my_source; -- references secret 'my_kafka_secret' that does not exist\n\n-- after\nCREATE SECRET my_kafka_secret WITH (type='kafka', ...);\nSELECT * FROM my_source;","handlingStrategy":"try-catch","validationCode":"// Before resolving a secret, check it exists:\nasync fn secret_exists(manager: &SecretManagerRef, id: &SecretId) -> bool {\n    manager.list().await.map(|secrets| secrets.contains_key(id)).unwrap_or(false)\n}","typeGuard":"fn validate_secret_lookup(result: &Result<Secret, SecretError>) -> Option<&Secret> {\n    match result {\n        Ok(s) => Some(s),\n        Err(SecretError::ItemNotFound(id)) => {\n            tracing::warn!(\"secret {} not found; was CREATE SECRET run?\", id);\n            None\n        }\n        _ => None,\n    }\n}","tryCatchPattern":"match manager.get(secret_id).await {\n    Ok(secret) => use_secret(secret),\n    Err(SecretError::ItemNotFound(id)) => {\n        // prompt user to CREATE SECRET or fall back to explicit credentials\n        return Err(anyhow!(\"secret {id} missing; run CREATE SECRET first\"));\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Always CREATE SECRET before creating objects that reference it.","List existing secrets to verify names/ids before use.","Verify you operate against the same cluster/database where the secret was created.","Include secret re-creation in environment restore/clone procedures."],"tags":["secret","not-found","lookup"],"backgroundTag":"record-not-found","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}