{"record":{"id":"8ff653e18085c43f","repo":"semaphoreui/semaphore","slug":"encryption-keys-active-s-key-no-key-labelled-q","errorCode":null,"errorMessage":"encryption_keys.active.%s_key: no key labelled %q","messagePattern":"encryption_keys\\.active\\.(.+?)_key: no key labelled %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/config.go","lineNumber":1543,"sourceCode":"\tif enc == nil {\n\t\treturn [2]string{}\n\t}\n\tl, f := pick(enc.Active)\n\treturn [2]string{l, f}\n}\n\n// resolveActiveKey resolves the active key material for one purpose: an active\n// label wins, then an active filename (in KeysFolder, relative), then the flat\n// fallback. A filename not already loaded from the folder is read and registered.\nfunc resolveActiveKey(enc *EncryptionKeysConfig, flat string, byLabel map[string]string,\n\taddLabeled func(string, string) error, ptr [2]string, kind string) (string, error) {\n\n\tlabel, file := ptr[0], ptr[1]\n\n\tif label != \"\" {\n\t\tmaterial, ok := byLabel[label]\n\t\tif !ok {\n\t\t\treturn \"\", fmt.Errorf(\"encryption_keys.active.%s_key: no key labelled %q\", kind, label)\n\t\t}\n\t\treturn material, nil\n\t}\n\n\tif file != \"\" {\n\t\tif material, ok := byLabel[file]; ok {\n\t\t\treturn material, nil\n\t\t}\n\t\tpath := file\n\t\tif !filepath.IsAbs(path) && enc != nil {\n\t\t\tpath = filepath.Join(enc.KeysFolder, file)\n\t\t}\n\t\tdata, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"encryption_keys.active.%s_key_file: %w\", kind, err)\n\t\t}\n\t\tmaterial := strings.TrimSpace(string(data))\n\t\tif err := addLabeled(file, material); err != nil {","sourceCodeStart":1525,"sourceCodeEnd":1561,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/util/config.go#L1525-L1561","documentation":"resolveActiveKey returns this error when encryption_keys.active.<kind>_key names a label that is not present in the loaded key registry (inline keys map or keys_folder files). The active pointer references a key that was never defined.","triggerScenarios":"`encryption_keys.active.secret_key: \"prod1\"` with no `keys.prod1` entry and no file named prod1 in keys_folder; renaming a key label without updating the active pointer; keys_folder failing to load (so its labels are absent).","commonSituations":"Renamed key entries in config; K8s mounted folder where files got renamed; typos in the active label; upgrading to the new encryption_keys schema with stale active values.","solutions":["Make the active label match an existing key: add `encryption_keys.keys.<label>` or a file with that name in keys_folder","List available labels (inline keys map + filenames in keys_folder) and fix the typo in active.<kind>_key","If you meant a file, set active.<kind>_file instead of _key","Clear the active pointer to fall back to the legacy flat key fields"],"exampleFix":"# before\nencryption_keys:\n  active:\n    secret_key: \"prod-1\"\n  keys:\n    production: {value: \"k1\"}\n# after\nencryption_keys:\n  active:\n    secret_key: \"production\"\n  keys:\n    production: {value: \"k1\"}","handlingStrategy":"validation","validationCode":"if cfg.Encryption != nil && cfg.Encryption.Active.SecretKey != \"\" {\n    if _, ok := cfg.Encryption.Keys[cfg.Encryption.Active.SecretKey]; !ok {\n        return fmt.Errorf(\"active.secret_key %q has no matching keys entry\",\n            cfg.Encryption.Active.SecretKey)\n    }\n}","typeGuard":"func labelLoaded(label string, byLabel map[string]string) bool {\n    _, ok := byLabel[label]\n    return ok\n}","tryCatchPattern":"material, err := resolveActiveKey(enc, flat, byLabel, addLabeled, ptr, \"access\")\nif err != nil {\n    return nil, fmt.Errorf(\"encryption setup failed: %w\", err)\n}","preventionTips":["Keep key labels and active pointers in the same config review/change","Grep keys_folder filenames and the keys map before renaming labels","Prefer active.*_file with keys_folder for K8s-managed keys to avoid label drift"],"tags":["config","encryption","reference","semaphore"],"backgroundTag":"invalid-config-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}