{"record":{"id":"4baa61101e3cf650","repo":"risingwavelabs/risingwave","slug":"oss-access-key-secret-not-found-from-environment-v","errorCode":null,"errorMessage":"OSS_ACCESS_KEY_SECRET not found from environment variables","messagePattern":"OSS_ACCESS_KEY_SECRET not found from environment variables","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/object_store/src/object/opendal_engine/oss.rs","lineNumber":42,"sourceCode":"use crate::object::object_metrics::ObjectStoreMetrics;\n\nimpl OpendalObjectStore {\n    /// create opendal oss engine.\n    pub fn new_oss_engine(\n        bucket: String,\n        root: String,\n        config: Arc<ObjectStoreConfig>,\n        metrics: Arc<ObjectStoreMetrics>,\n    ) -> ObjectResult<Self> {\n        // Create oss backend builder.\n        let mut builder = Oss::default().bucket(&bucket).root(&root);\n\n        let endpoint = std::env::var(\"OSS_ENDPOINT\")\n            .unwrap_or_else(|_| panic!(\"OSS_ENDPOINT not found from environment variables\"));\n        let access_key_id = std::env::var(\"OSS_ACCESS_KEY_ID\")\n            .unwrap_or_else(|_| panic!(\"OSS_ACCESS_KEY_ID not found from environment variables\"));\n        let access_key_secret = std::env::var(\"OSS_ACCESS_KEY_SECRET\").unwrap_or_else(|_| {\n            panic!(\"OSS_ACCESS_KEY_SECRET not found from environment variables\")\n        });\n\n        builder = builder\n            .endpoint(&endpoint)\n            .access_key_id(&access_key_id)\n            .access_key_secret(&access_key_secret);\n\n        let op = new_operator(\n            &config,\n            Operator::new(builder)?.layer(LoggingLayer::default()),\n        );\n\n        Ok(Self {\n            op,\n            media_type: MediaType::Oss,\n            config,\n            metrics,\n        })","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/object_store/src/object/opendal_engine/oss.rs#L24-L60","documentation":"new_oss_engine panics when OSS_ACCESS_KEY_SECRET is missing. This is the third required OSS credential variable; the OSS builder calls access_key_secret with it. Like the sibling checks, it panics rather than returning an error.","triggerScenarios":"Calling new_oss_engine with OSS_ENDPOINT and OSS_ACCESS_KEY_ID set but OSS_ACCESS_KEY_SECRET unset.","commonSituations":"Secrets manager writes only the key id; secret value contains leading/trailing whitespace or quotes causing a lookup mismatch; docker -e flag quoting dropped the variable.","solutions":["Export OSS_ACCESS_KEY_SECRET with the Aliyun access key secret before startup.","Confirm all three OSS_* variables are set and non-empty (env | grep OSS_); note empty-string values still fail authentication later.","If using a secret injection system, ensure the env name matches OSS_ACCESS_KEY_SECRET exactly (case-sensitive)."],"exampleFix":"// before\nlet access_key_secret = std::env::var(\"OSS_ACCESS_KEY_SECRET\")\n    .unwrap_or_else(|_| panic!(\"OSS_ACCESS_KEY_SECRET not found from environment variables\"));\n// after (shell)\nexport OSS_ACCESS_KEY_SECRET='xxxxxxxxxxxxxxxx'","handlingStrategy":"validation","validationCode":"if std::env::var(\"OSS_ACCESS_KEY_SECRET\").map(|v| v.is_empty()).unwrap_or(true) {\n    return Err(anyhow!(\"OSS_ACCESS_KEY_SECRET must be set\"));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount the secret value verbatim; avoid shells that strip or re-quote it.","Rotate secrets by updating all replicas' env at once to avoid partial credential sets.","Include the secret var in deployment liveness/config checks."],"tags":["object-store","oss","credentials","env","panic"],"backgroundTag":"missing-env-var","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}