{"record":{"id":"a94d72e75b07871f","repo":"iflytek/astron-agent","slug":"load-s-w","errorCode":null,"errorMessage":"load %s: %w","messagePattern":"load (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/tenant/config/bootstrap_credentials.go","lineNumber":98,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc credentialFromEnvironmentOrFile(valueEnvironment, fileEnvironment string) (string, error) {\n\tif value := strings.TrimSpace(os.Getenv(valueEnvironment)); value != \"\" {\n\t\tif err := validateCredential(valueEnvironment, value); err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\treturn value, nil\n\t}\n\n\tfileName := strings.TrimSpace(os.Getenv(fileEnvironment))\n\tif fileName == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s or %s is required\", valueEnvironment, fileEnvironment)\n\t}\n\tvalue, err := readCredentialFile(fileName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"load %s: %w\", fileEnvironment, err)\n\t}\n\tif err := validateCredential(valueEnvironment, value); err != nil {\n\t\treturn \"\", err\n\t}\n\treturn value, nil\n}\n\nfunc readCredentialFile(fileName string) (string, error) {\n\tfile, err := openCredentialFileNoFollow(fileName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer func() {\n\t\t_ = file.Close()\n\t}()\n\n\topenedInfo, err := file.Stat()\n\tif err != nil {","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/config/bootstrap_credentials.go#L80-L116","documentation":"When the direct credential env var is unset, credentialFromEnvironmentOrFile falls back to reading the file named by the *_FILE env var. 'load %s: %w' wraps a readCredentialFile failure — the file could not be opened, is not a regular non-symlink file, exceeds 4096 bytes, or cannot be read — with the variable name for context.","triggerScenarios":"TENANT_KEY_FILE or TENANT_SECRET_FILE is set but readCredentialFile fails: path does not exist, permission denied, path is a symlink or directory, file larger than maxCredentialFileBytes (4096), or an I/O error during read.","commonSituations":"Secret mounted as a symlinked directory (older k8s symlink mounts) rejected by the no-follow open; wrong path or typo in _FILE var; file mounted with wrong permissions/owner; the mounted secret accidentally contains a large multi-line bundle.","solutions":["Check the wrapped cause: 'no such file or directory' → fix the path; 'permission denied' → fix file mode/owner.","Ensure the path points to a regular file, not a symlink or directory (readCredentialFile explicitly rejects symlinks).","Keep the secret file ≤4096 bytes with a single-line value (it is trimmed of surrounding whitespace).","Verify the volume mount in the pod spec projects the secret key as a plain file at that exact path."],"exampleFix":"// before\nTENANT_KEY_FILE=/run/secrets/tenant/key.txt   # file does not exist\n\n// after (k8s volume)\nvolumes:\n  - name: tenant-bootstrap\n    secret: { secretName: tenant-bootstrap, items: [{ key: tenant-key, path: key }] }\n# TENANT_KEY_FILE=/run/secrets/tenant-bootstrap/key","handlingStrategy":"validation","validationCode":"if p := os.Getenv(\"TENANT_KEY_FILE\"); p != \"\" {\n\tif info, err := os.Stat(p); err != nil || !info.Mode().IsRegular() {\n\t\treturn fmt.Errorf(\"TENANT_KEY_FILE %s is not a readable regular file\", p)\n\t}\n}","typeGuard":null,"tryCatchPattern":"value, err := readCredentialFile(name)\nif err != nil {\n\treturn \"\", fmt.Errorf(\"load %s: %w\", fileEnvironment, err)\n}","preventionTips":["Mount secrets as regular projected files, not symlinked tmpfs dirs.","Set restrictive but sufficient file modes (0400) and correct ownership.","Keep secret files small (single line, well under 4096 bytes)."],"tags":["file","credentials","secrets","go"],"backgroundTag":"file-read-failed","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}