{"record":{"id":"8e8f4e3b4be92238","repo":"bytebase/bytebase","slug":"cannot-find-secret-s","errorCode":null,"errorMessage":"cannot find secret %s","messagePattern":"cannot find secret (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/component/secret/azure.go","lineNumber":42,"sourceCode":"\t}\n\n\t// The URL should be the Key Vault URL (e.g., https://myvault.vault.azure.net/)\n\tvaultURL := externalSecret.Url\n\tif vaultURL == \"\" {\n\t\treturn \"\", errors.New(\"missing Azure Key Vault URL\")\n\t}\n\n\tclient, err := azsecrets.NewClient(vaultURL, cred, nil)\n\tif err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"failed to create Azure Key Vault client\")\n\t}\n\n\t// Get the secret using the secret name.\n\t// Empty version string means get the latest version.\n\tresp, err := client.GetSecret(ctx, externalSecret.SecretName, \"\", nil)\n\tif err != nil {\n\t\tif strings.Contains(err.Error(), \"SecretNotFound\") {\n\t\t\treturn \"\", errors.Wrapf(err, \"cannot find secret %s\", externalSecret.SecretName)\n\t\t}\n\t\treturn \"\", errors.Wrapf(err, \"failed to get Azure Key Vault secret %s\", externalSecret.SecretName)\n\t}\n\n\tif resp.Value == nil {\n\t\treturn \"\", errors.Errorf(\"empty secret value for %s\", externalSecret.SecretName)\n\t}\n\n\treturn *resp.Value, nil\n}\n","sourceCodeStart":24,"sourceCodeEnd":53,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/component/secret/azure.go#L24-L53","documentation":"The Azure Key Vault GetSecret call returned a SecretNotFound error, meaning no secret (or no enabled version) exists at the given name in the vault. Bytebase detects the 'SecretNotFound' string and wraps it as 'cannot find secret %s'.","triggerScenarios":"client.GetSecret(ctx, externalSecret.SecretName, \"\", nil) returns an error containing 'SecretNotFound' in getSecretFromAzure — the SecretName in the Bytebase config does not match a secret in the vault pointed to by Url.","commonSituations":"Typo in the secret name; secret deleted or disabled in Key Vault; secret exists in a different vault than the configured vault URL; name casing mismatch (Key Vault names are lowercase, hyphens allowed); RBAC grants exist but the secret itself was purged.","solutions":["Verify SecretName in the Bytebase config exactly matches a secret in the configured vault (az keyvault secret show --vault-name <vault> -n <name>)","Check the secret is enabled and not deleted/purged in Key Vault","Confirm the vault URL points at the vault that actually contains the secret","Ensure the managed identity / service principal has Key Vault Secrets User (get) RBAC on the vault"],"exampleFix":"// before\nSecretName: \"DbPassword\" // Key Vault names are lowercase\n// after\nSecretName: \"db-password\"","handlingStrategy":"validation","validationCode":"// run before configuring:\naz keyvault secret show --vault-name <vault> --name <SecretName>\n// non-zero exit / 'Secret not found' means the name or vault is wrong","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"SecretNotFound\") {\n\treturn fmt.Errorf(\"secret %q not found in vault %s; verify name (lowercase, no underscores), vault URL, and that the secret is enabled\", name, vaultURL)\n}","preventionTips":["Use lowercase names with hyphens — Key Vault forbids uppercase and underscores","Validate the secret exists via az CLI or a GetSecret probe when saving settings","Pin the vault URL and secret name together in one reviewed config source","Enable Key Vault soft-delete so accidental deletions are recoverable"],"tags":["azure","key-vault","not-found","configuration"],"backgroundTag":"resource-not-found","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}