{"record":{"id":"54a5f6e5dc1ba7d5","repo":"risingwavelabs/risingwave","slug":"enable-config-load-can-t-be-enabled-in-this-envi","errorCode":null,"errorMessage":"`enable_config_load` can't be enabled in this environment","messagePattern":"`enable_config_load` can't be enabled in this environment","errorType":"validation","errorClass":"ConnectorError","httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/connection.rs","lineNumber":268,"sourceCode":"                        builder = builder.account_key(azblob_account_key);\n                    }\n                    if let Some(azblob_endpoint_url) = &common.azblob_endpoint_url {\n                        builder = builder.endpoint(azblob_endpoint_url);\n                    }\n                    builder = builder.root(root.as_str()).container(bucket.as_str());\n                    let op = Operator::new(builder)?;\n                    op.check().await?;\n                }\n                _ => {\n                    bail!(\"Unsupported scheme: {}\", scheme);\n                }\n            }\n        }\n\n        if env_var_is_true(DISABLE_DEFAULT_CREDENTIAL)\n            && matches!(common.enable_config_load, Some(true))\n        {\n            bail!(\"`enable_config_load` can't be enabled in this environment\");\n        }\n\n        if common.hosted_catalog.unwrap_or(false) {\n            // If `hosted_catalog` is set, we don't need to test the catalog, but just ensure no catalog fields are set.\n            if common.catalog_type.is_some() {\n                bail!(\"`catalog.type` must not be set when `hosted_catalog` is set\");\n            }\n            if common.catalog_uri.is_some() {\n                bail!(\"`catalog.uri` must not be set when `hosted_catalog` is set\");\n            }\n            if common.catalog_name.is_some() {\n                bail!(\"`catalog.name` must not be set when `hosted_catalog` is set\");\n            }\n            if self.jdbc_user.is_some() {\n                bail!(\"`catalog.jdbc.user` must not be set when `hosted_catalog` is set\");\n            }\n            if self.jdbc_password.is_some() {\n                bail!(\"`catalog.jdbc.password` must not be set when `hosted_catalog` is set\");","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/connection.rs#L250-L286","documentation":"Raised in `IcebergConnection::validate_connection` when the environment sets the `DISABLE_DEFAULT_CREDENTIAL` variable (e.g. hosted/managed deployments that forbid implicit credentials) and the connection nevertheless sets `enable_config_load = true`. This option would let OpenDAL load credentials from default config files, which the deployment policy disallows.","triggerScenarios":"Calling validate_connection on an Iceberg connection where both: the environment variable `DISABLE_DEFAULT_CREDENTIAL` is truthy, and `enable_config_load` is explicitly Some(true) in the connection options.","commonSituations":"Running in a managed/hosted RisingWave environment that disables default credential loading, while a connection config copied from a self-hosted setup still contains `enable_config_load=true`.","solutions":["Remove `enable_config_load = true` from the connection options.","Provide explicit credentials instead (e.g. `s3.access.key`/`s3.secret.key` or `gcs.credential`).","If you truly need config-file loading, run in an environment where `DISABLE_DEFAULT_CREDENTIAL` is not set."],"exampleFix":"// before\nWITH (connector='iceberg', warehouse.path='s3://b/w', enable_config_load=true)\n// after\nWITH (connector='iceberg', warehouse.path='s3://b/w', s3.access.key='...', s3.secret.key='...')","handlingStrategy":"validation","validationCode":"if std::env::var(\"DISABLE_DEFAULT_CREDENTIAL\").map(|v| v == \"true\").unwrap_or(false)\n    && opts.contains_key(\"enable_config_load\") { return Err(\"enable_config_load not allowed here\"); }","typeGuard":null,"tryCatchPattern":"if let Err(e) = conn.validate_connection().await {\n    if e.to_string().contains(\"enable_config_load\") {\n        log::warn(\"environment forbids default credential loading; provide explicit credentials\");\n    }\n    return Err(e.into());\n}","preventionTips":["Never enable enable_config_load in hosted/managed deployments","Supply explicit access keys instead of relying on default config files","Document env policy (DISABLE_DEFAULT_CREDENTIAL) in deployment docs"],"tags":["iceberg","security","config","env-var"],"backgroundTag":"feature-not-enabled","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}