{"record":{"id":"49ce4b5a1a11f078","repo":"vitessio/vitess","slug":"cannot-load-credentials-from-path-template-s-w-49ce4b","errorCode":null,"errorMessage":"cannot load credentials from path template %s: %w","messagePattern":"cannot load credentials from path template (.+?): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vtadmin/vtsql/config.go","lineNumber":117,"sourceCode":"\teffectiveUser := fs.String(\"effective-user\", \"\", \"username to send queries on behalf of\")\n\tcredentialsUsername := fs.String(\"credentials-username\", \"\",\n\t\t\"A string specifying the Username to use for authenticating with vtgate. \"+\n\t\t\t\"Used with credentials-password in place of credentials-path-tmpl, in cases where providing a static file cannot be done.\")\n\tcredentialsPassword := fs.String(\"credentials-password\", \"\",\n\t\t\"A string specifying a Password to use for authenticating with vtgate. \"+\n\t\t\t\"Used with credentials-username in place of credentials-path-tmpl, in cases where providing a static file cannot be done.\")\n\tif err := fs.Parse(args); err != nil {\n\t\treturn err\n\t}\n\n\tvar username, password string\n\n\t// First load credentials from credentials-path-tmpl, if provided\n\tvar tmplStrCreds *grpcclient.StaticAuthClientCreds\n\tif *credentialsTmplStr != \"\" {\n\t\t_creds, path, err := credentials.LoadFromTemplate(*credentialsTmplStr, c)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot load credentials from path template %s: %w\", *credentialsTmplStr, err)\n\t\t}\n\n\t\tc.CredentialsPath = path\n\t\ttmplStrCreds = _creds\n\t}\n\tif tmplStrCreds != nil {\n\t\tusername = tmplStrCreds.Username\n\t\tpassword = tmplStrCreds.Password\n\t}\n\n\t// If credentials-username and credentials-password are provided, use those credentials instead\n\tif *credentialsUsername != \"\" {\n\t\tusername = *credentialsUsername\n\t}\n\tif *credentialsPassword != \"\" {\n\t\tpassword = *credentialsPassword\n\t}\n","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtadmin/vtsql/config.go#L99-L135","documentation":"Same credential-template loading failure as the vtctldclient config, but in the vtadmin vtsql package: Parse renders `credentials-path-tmpl` and loads static gRPC auth credentials for the vtgate connection. Any template-render or file-read/parse error is wrapped with the template string and returned from Parse.","triggerScenarios":"Calling vtsql.ParseConfig with a non-empty credentials-path-tmpl when the template fails to render against the config struct, or the resolved credentials file is missing, unreadable, or malformed.","commonSituations":"Deployed vtadmin config references a template field that does not exist; credentials file permissions; Kubernetes secret not mounted; stale path after home-directory or cluster-name change.","solutions":["Manually render the template with the same config values and confirm the resulting file path exists and is readable.","Validate the credentials file format expected by grpcclient static auth (JSON user/password).","Fix field names in the template so they match exported fields of the vtsql config struct.","Use a literal credentials-path instead of the template variant if templating is not needed."],"exampleFix":"// before\n--credentials-path-tmpl \"/etc/vtadmin/creds/{{.Cell}}\"\n// after (cell field not set in config)\n--credentials-path \"/etc/vtadmin/creds/zone1\"","handlingStrategy":"validation","validationCode":"// Shell: verify the template renders to a readable file for the same config values\nCREDS_PATH=$(render_template \"$CREDS_TMPL\")\ntest -r \"$CREDS_PATH\" || { echo \"vtsql credentials not found at $CREDS_PATH\"; exit 1; }","typeGuard":null,"tryCatchPattern":"cfg, err := vtsql.ParseConfig(fs, flags, args); if err != nil && strings.Contains(err.Error(), \"cannot load credentials\") { /* check template fields and file */ }","preventionTips":["Ensure all template fields are set in the config struct before rendering.","Mount credentials via a secret volume and check mount readiness before starting vtadmin.","Log the rendered path (not contents) on startup to ease debugging."],"tags":["vtadmin","vtsql","credentials","configuration"],"backgroundTag":"credentials-load-failed","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}