{"record":{"id":"522aee8937003ed4","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-parse-auth-config-w","errorCode":null,"errorMessage":"cannot parse auth config: %w","messagePattern":"cannot parse auth config: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/azure/api.go","lineNumber":96,"sourceCode":"\tv, err := configMap.Get(sdc, func() (any, error) { return newAPIConfig(sdc, baseDir) })\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn v.(*apiConfig), nil\n}\n\nfunc newAPIConfig(sdc *SDConfig, baseDir string) (*apiConfig, error) {\n\tif sdc.SubscriptionID == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing `subscription_id` config option\")\n\t}\n\tport := sdc.Port\n\tif port == 0 {\n\t\tport = 80\n\t}\n\n\tac, err := sdc.HTTPClientConfig.NewConfig(baseDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse auth config: %w\", err)\n\t}\n\tproxyAC, err := sdc.ProxyClientConfig.NewConfig(baseDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse proxy auth config: %w\", err)\n\t}\n\n\tenvironment := sdc.Environment\n\tif environment == \"\" {\n\t\tenvironment = \"AZURECLOUD\"\n\t}\n\tenv, err := getCloudEnvByName(environment)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot read configs for `environment: %q`: %w\", environment, err)\n\t}\n\n\trefreshToken, err := getRefreshTokenFunc(sdc, ac, proxyAC, env)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/azure/api.go#L78-L114","documentation":"Azure SD wraps errors from HTTPClientConfig.NewConfig (parsing the auth section: bearer token, basic auth, OAuth2 client credentials, TLS settings) with 'cannot parse auth config'. The underlying error names the exact field (e.g. invalid client_secret_file path, bad TLS config).","triggerScenarios":"newAPIConfig calls sdc.HTTPClientConfig.NewConfig(baseDir); it fails when referenced files (client_secret_file, bearer_token_file, CA cert/key files) are missing/unreadable, or auth/oauth2/TLS fields are invalid or mutually inconsistent (e.g. both client_id+client_secret and bearer_token set).","commonSituations":"client_secret_file path wrong relative to -promscrape.config file's baseDir; file permissions deny read; mixing incompatible auth options; malformed tls_config cert paths.","solutions":["Read the wrapped error (%w) for the exact offending field and fix it in the azure_sd_config's http_client_config/auth section.","Verify all referenced *_file paths exist and are readable by the VictoriaMetrics process, remembering paths are resolved relative to the scrape config's directory.","Provide exactly one auth mechanism (client_id/client_secret for Azure, or bearer_token_file) and remove conflicting ones.","Validate the config upfront with -promscrape.configCheck or the /config web endpoint before reloading."],"exampleFix":"# before\nazure_sd_configs:\n  - subscription_id: \"...\"\n    http_client_config:\n      oauth2:\n        client_id: \"...\"\n        client_secret_file: ./secrets/azure-secret   # file not found\n# after\nazure_sd_configs:\n  - subscription_id: \"...\"\n    client_id: \"...\"\n    client_secret_file: /etc/vm/azure-secret   # absolute, existing path\n    tenant_id: \"...\"","handlingStrategy":"try-catch","validationCode":"// Go: check auth files before handing the config to VM\nfunc authFilesExist(secretFile string) error {\n\tif secretFile == \"\" {\n\t\treturn nil\n\t}\n\tif _, err := os.Stat(secretFile); err != nil {\n\t\treturn fmt.Errorf(\"client_secret_file %q unreadable: %w\", secretFile, err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := sdc.HTTPClientConfig.NewConfig(baseDir); err != nil {\n\tvar pathErr *os.PathError\n\tif errors.As(err, &pathErr) {\n\t\tlog.Fatalf(\"auth file missing for Azure SD: %v\", pathErr)\n\t}\n\treturn fmt.Errorf(\"cannot parse auth config: %w\", err)\n}","preventionTips":["Use absolute paths for client_secret_file/bearer_token_file/CA files.","Ensure the VM process user can read all referenced secret files.","Set only one auth mechanism to avoid conflicting options.","Run -promscrape.configCheck after every auth-related config change."],"tags":["config","azure","auth","tls"],"backgroundTag":"auth-config-parse-failed","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}