{"record":{"id":"63d1895a2d33fd63","repo":"dgraph-io/dgraph","slug":"error-reading-acl-secret-key-from-file-s-s","errorCode":null,"errorMessage":"error reading ACL secret key from file: %s: %s","messagePattern":"error reading ACL secret key from file: (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"x/acl_enc_keys.go","lineNumber":66,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"flags: Encryption key set in both vault and encryption flags\")\n\t\t}\n\t\tvar err error\n\t\tif encKey, err = os.ReadFile(encKeyFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading encryption key from file: %s: %s\", encKeyFile, err)\n\t\t}\n\t}\n\tif l := len(encKey); encKey != nil && l != 16 && l != 32 && l != 64 {\n\t\treturn nil, fmt.Errorf(\"encryption key must have length of 16, 32, or 64 bytes, got %d bytes instead\", l)\n\t}\n\n\taclSecretFile := aclSuperFlag.GetPath(flagAclKeyFile)\n\tif aclSecretFile != \"\" {\n\t\tif aclKey != nil {\n\t\t\treturn nil, fmt.Errorf(\"flags: ACL secret key set in both vault and acl flags\")\n\t\t}\n\t\tvar err error\n\t\tif aclKey, err = os.ReadFile(aclSecretFile); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading ACL secret key from file: %s: %s\", aclSecretFile, err)\n\t\t}\n\t}\n\n\tkeys := &Keys{\n\t\tAclSecretKeyBytes: aclKey,\n\t\tAclAccessTtl:      aclSuperFlag.GetDuration(flagAclAccessTtl),\n\t\tAclRefreshTtl:     aclSuperFlag.GetDuration(flagAclRefreshTtl),\n\t\tEncKey:            encKey,\n\t}\n\n\tif aclKey != nil {\n\t\talgStr := aclSuperFlag.GetString(flagAclJwtAlg)\n\t\taclAlg := jwt.GetSigningMethod(algStr)\n\t\tif aclAlg == nil {\n\t\t\treturn nil, fmt.Errorf(\"Unsupported JWT signing algorithm for ACL: %v\", algStr)\n\t\t}\n\t\tif err := checkAclKeyLength(aclAlg, aclKey); err != nil {\n\t\t\treturn nil, err","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/x/acl_enc_keys.go#L48-L84","documentation":"After resolving the ACL secret key file path from the superflag, GetEncAclKeys reads it with os.ReadFile. This error wraps the OS failure when the file cannot be read (missing, unreadable permissions, or a directory).","triggerScenarios":"Calling GetEncAclKeys with flagAclKeyFile set to a path that does not exist, has insufficient permissions, is a directory, or was deleted/mounted-empty at runtime.","commonSituations":"Kubernetes secret not mounted at the expected path; wrong relative path because the binary runs from a different working directory; file permissions changed by a container image update; secret file not yet mounted when the process starts.","solutions":["Verify the file exists at the exact path and is readable by the process user (ls -l, cat as the service user)","Fix mount configuration so the Kubernetes/Docker secret is present before process start","Use an absolute path instead of a path relative to the working directory","Check the wrapped OS error in the message for the concrete cause (no such file, permission denied)"],"exampleFix":"// before\n--acl \"hmac-secret-file=./acl_key\" # relative, file not there\n// after\n--acl \"hmac-secret-file=/dgraph/acl/acl_key\" # absolute, verified readable","handlingStrategy":"validation","validationCode":"if path := aclSuperFlag.GetPath(flagAclKeyFile); path != \"\" {\n    fi, err := os.Stat(path)\n    if err != nil { return fmt.Errorf(\"ACL key file inaccessible: %w\", err) }\n    if fi.IsDir() { return fmt.Errorf(\"ACL key file is a directory: %s\", path) }\n    if _, err := os.ReadFile(path); err != nil { return fmt.Errorf(\"ACL key file unreadable: %w\", err) }\n}","typeGuard":null,"tryCatchPattern":"if _, err := x.GetEncAclKeys(flag, encKey); err != nil {\n    var pe *os.PathError\n    if errors.As(err, &pe) {\n        log.Fatalf(\"check ACL key file %s: %v\", pe.Path, pe.Err)\n    }\n    return err\n}","preventionTips":["Mount secrets before the process starts (init containers / depends_on)","Use absolute paths in container deployments","Verify the process user has read permission on the key file","Check the wrapped os error in the message for the root cause"],"tags":["config","filesystem","acl","file-io"],"backgroundTag":"secret-key-file-not-found","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}