{"record":{"id":"8c2b4679cdd6711b","repo":"risingwavelabs/risingwave","slug":"obs-secret-access-key-not-found-from-environment-v","errorCode":null,"errorMessage":"OBS_SECRET_ACCESS_KEY not found from environment variables","messagePattern":"OBS_SECRET_ACCESS_KEY not found from environment variables","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/object_store/src/object/opendal_engine/obs.rs","lineNumber":42,"sourceCode":"use crate::object::object_metrics::ObjectStoreMetrics;\n\nimpl OpendalObjectStore {\n    /// create opendal obs engine.\n    pub fn new_obs_engine(\n        bucket: String,\n        root: String,\n        config: Arc<ObjectStoreConfig>,\n        metrics: Arc<ObjectStoreMetrics>,\n    ) -> ObjectResult<Self> {\n        // Create obs backend builder.\n        let mut builder = Obs::default().bucket(&bucket).root(&root);\n\n        let endpoint = std::env::var(\"OBS_ENDPOINT\")\n            .unwrap_or_else(|_| panic!(\"OBS_ENDPOINT not found from environment variables\"));\n        let access_key_id = std::env::var(\"OBS_ACCESS_KEY_ID\")\n            .unwrap_or_else(|_| panic!(\"OBS_ACCESS_KEY_ID not found from environment variables\"));\n        let secret_access_key = std::env::var(\"OBS_SECRET_ACCESS_KEY\").unwrap_or_else(|_| {\n            panic!(\"OBS_SECRET_ACCESS_KEY not found from environment variables\")\n        });\n\n        builder = builder\n            .endpoint(&endpoint)\n            .access_key_id(&access_key_id)\n            .secret_access_key(&secret_access_key);\n\n        let op = new_operator(\n            &config,\n            Operator::new(builder)?.layer(LoggingLayer::default()),\n        );\n\n        Ok(Self {\n            op,\n            media_type: MediaType::Obs,\n            config,\n            metrics,\n        })","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/object_store/src/object/opendal_engine/obs.rs#L24-L60","documentation":"new_obs_engine reads the OBS secret access key from OBS_SECRET_ACCESS_KEY and panics if unset, as OBS signing requires both the access key id and its secret. This is the last of the three required OBS env vars checked at store construction.","triggerScenarios":"Using an obs:// remote store with OBS_ENDPOINT and OBS_ACCESS_KEY_ID set but OBS_SECRET_ACCESS_KEY missing from the environment.","commonSituations":"Secrets partially synced into the deployment (e.g. only the key id mounted), typo in the secret variable name, or rotation removing the secret before restart.","solutions":["Export OBS_SECRET_ACCESS_KEY with the secret matching OBS_ACCESS_KEY_ID before starting RisingWave","Verify the Kubernetes secret/docker env includes the secret key value","Confirm the key id and secret pair are valid and from the same Huawei Cloud credential set","Check env visibility inside the process: env | grep OBS_SECRET"],"exampleFix":"# before\nenv OBS_ENDPOINT=... OBS_ACCESS_KEY_ID=AK ./risingwave  # secret missing -> panic\n# after\nenv OBS_ENDPOINT=... OBS_ACCESS_KEY_ID=AK OBS_SECRET_ACCESS_KEY=SK ./risingwave","handlingStrategy":"validation","validationCode":"if std::env::var(\"OBS_SECRET_ACCESS_KEY\").is_err() {\n    eprintln!(\"OBS_SECRET_ACCESS_KEY must be set for obs:// object store\");\n    std::process::exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount both OBS_ACCESS_KEY_ID and OBS_SECRET_ACCESS_KEY from the same secret object so they rotate together","Validate the full OBS env var trio (endpoint, key id, secret) in an entrypoint preflight","Never set the key id without its secret in deployment templates"],"tags":["rust","obs","huawei","credentials","env-var","panic"],"backgroundTag":"missing-env-var","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}