{"record":{"id":"94219fd2da8e4132","repo":"risingwavelabs/risingwave","slug":"field-not-found-in-secret","errorCode":null,"errorMessage":"Field '{}' not found in secret","messagePattern":"Field '(.+?)' not found in secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/common/secret/src/vault_client.rs","lineNumber":265,"sourceCode":"        //         \"version\": 1\n        //       }\n        //     },\n        //     \"wrap_info\": null,\n        //     \"warnings\": null,\n        //     \"auth\": null,\n        //     \"mount_type\": \"kv\"\n        //   }\n\n        let secret_response: VaultSecretResponse = response\n            .json()\n            .await\n            .context(\"Failed to parse Vault secret response\")?;\n\n        let field_value = secret_response\n            .data\n            .data\n            .get(&self.config.field)\n            .ok_or_else(|| anyhow::anyhow!(\"Field '{}' not found in secret\", self.config.field))?;\n\n        let secret_bytes = match field_value {\n            Value::String(s) => s.as_bytes().to_vec(),\n            _ => serde_json::to_vec(field_value)\n                .context(\"Failed to serialize field value to bytes\")?,\n        };\n\n        Ok(secret_bytes)\n    }\n\n    async fn get_token_internal(&self, force_refresh: bool) -> Result<String> {\n        match &self.config.auth {\n            HashiCorpVaultAuth::Token { auth_token } => Ok(auth_token.clone()),\n            HashiCorpVaultAuth::AppRole {\n                auth_role_id,\n                auth_secret_id,\n            } => {\n                // Create cache key with vault base URL and role_id","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/vault_client.rs#L247-L283","documentation":"The Vault KV-v2 response was parsed successfully, but the configured field (config.field) does not exist inside the secret's data map. The client reads exactly one named key from the secret payload, so a missing key aborts the conversion.","triggerScenarios":"process_secret_response looks up self.config.field in the response's data.data JSON object and the key is absent — e.g. secret stores 'password' but the secret declaration asks for field 'pwd'.","commonSituations":"Field name typo in the CREATE SECRET definition; secret was rotated/rewritten with different keys; reading from the wrong secret path that has a different schema; KV-v1 vs KV-v2 path confusion yielding a differently-shaped payload.","solutions":["Compare the configured field name with the actual keys via 'vault kv get -format=json <path>' and correct the field in the secret definition","Verify the secret path points at the intended secret","Re-write the Vault secret to include the expected field if it was removed during rotation"],"exampleFix":"// before\nCREATE SECRET s WITH (backend='hashicorp_vault', field='pwd', ...);\n// after\nCREATE SECRET s WITH (backend='hashicorp_vault', field='password', ...);","handlingStrategy":"validation","validationCode":"// Confirm the field exists before configuring the secret\nlet body: serde_json::Value = vault_kv_get(path).await?;\nassert!(body[\"data\"][\"data\"].get(\"password\").is_some(), \"field 'password' missing in secret\");","typeGuard":"fn has_field(secret: &serde_json::Value, field: &str) -> bool {\n    secret[\"data\"][\"data\"].get(field).is_some()\n}","tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"not found in secret\") => {\n        eprintln!(\"check field name against 'vault kv get -format=json'\");\n    }\n    other => other?,\n}","preventionTips":["Verify field names with 'vault kv get -format=json' before writing the secret definition","Keep secret schemas stable across rotations, or update definitions in lockstep","Watch for KV-v1 vs KV-v2 payload shape differences"],"tags":["vault","config","json"],"backgroundTag":"unexpected-response-shape","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}