{"record":{"id":"b07bcd71753c1d94","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-create-http-client-for-q-w-b07bcd","errorCode":null,"errorMessage":"cannot create HTTP client for %q: %w","messagePattern":"cannot create HTTP client for %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/http/api.go","lineNumber":65,"sourceCode":"\nfunc newAPIConfig(sdc *SDConfig, baseDir string) (*apiConfig, error) {\n\tac, err := sdc.HTTPClientConfig.NewConfig(baseDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse auth config: %w\", err)\n\t}\n\tparsedURL, err := url.Parse(sdc.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse http_sd URL: %w\", err)\n\t}\n\tapiServer := fmt.Sprintf(\"%s://%s\", parsedURL.Scheme, parsedURL.Host)\n\n\tproxyAC, err := sdc.ProxyClientConfig.NewConfig(baseDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse proxy auth config: %w\", err)\n\t}\n\tclient, err := discoveryutil.NewClient(apiServer, ac, sdc.ProxyURL, proxyAC, &sdc.HTTPClientConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot create HTTP client for %q: %w\", apiServer, err)\n\t}\n\tcfg := &apiConfig{\n\t\tclient:        client,\n\t\tpath:          parsedURL.RequestURI(),\n\t\tsourceURL:     sdc.URL,\n\t\tcheckInterval: max(*SDCheckInterval/2, time.Second),\n\t\tfetchErrors:   metrics.GetOrCreateCounter(fmt.Sprintf(`promscrape_discovery_http_errors_total{type=\"fetch\",url=%q}`, sdc.URL)),\n\t\tparseErrors:   metrics.GetOrCreateCounter(fmt.Sprintf(`promscrape_discovery_http_errors_total{type=\"parse\",url=%q}`, sdc.URL)),\n\t}\n\tcfg.wg.Go(func() {\n\t\tcfg.run()\n\t})\n\treturn cfg, nil\n}\n\nfunc (cfg *apiConfig) init() {\n\tcfg.initOnce.Do(func() {\n\t\tcfg.refreshTargetsIfNeeded()","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/http/api.go#L47-L83","documentation":"This error wraps any failure from discoveryutil.NewClient when the http_sd discovery mechanism builds its HTTP client. NewClient validates the auth config (TLS, basic auth, OAuth2, headers) and proxy settings against the parsed apiServer host; if any of those cannot be turned into a usable HTTP client, the error is wrapped with the apiServer URL so the user knows which endpoint config is broken. It occurs at scrape-config start time, before any actual network requests are made.","triggerScenarios":"Calling SDConfig.MustStart(baseDir) with an http_sd_config whose HTTPClientConfig (TLS, basic_auth, oauth2) or ProxyClientConfig contains invalid settings, e.g. TLS certificate files that do not exist or cannot be read, malformed cert/key pairs, or an OAuth2 config missing required fields — NewClient returns an error which is wrapped here.","commonSituations":"Users point tls_config cert_file/key_file at paths that don't exist relative to baseDir, mount secrets after vmagent starts, use an expired or unreadable bearer token file, or copy a Prometheus http_sd_config with OAuth2 fields unsupported/incomplete in VictoriaMetrics.","solutions":["Check the wrapped inner error for the exact cause; verify all files referenced by http_sd_config (tls_config cert/key/ca, bearer_token_file, credentials) exist and are readable by the VictoriaMetrics process","Fix paths relative to the config's baseDir and confirm cert/key pairs match and are valid PEM","Remove or correct unsupported/invalid fields in http_sd_config (e.g. incomplete oauth2 block) and restart vmagent"],"exampleFix":"// before\n- http_sd_config:\n  - url: http://sd-api/targets\n    tls_config:\n      cert_file: /etc/vmagent/client.crt\n      key_file: /etc/vmagent/client.key\n// after\n- http_sd_config:\n  - url: http://sd-api/targets\n    tls_config:\n      cert_file: /etc/vmagent/tls/client.crt   # file exists and is readable\n      key_file: /etc/vmagent/tls/client.key    # matches client.crt","handlingStrategy":"validation","validationCode":"files := []string{tlsCfg.CertFile, tlsCfg.KeyFile, tlsCfg.CAFile, authCfg.BearerTokenFile}\nfor _, f := range files {\n\tif f != \"\" {\n\t\tif _, err := os.Stat(f); err != nil {\n\t\t\treturn fmt.Errorf(\"http_sd auth file %q unreadable: %w\", f, err)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"cfg, err := sdc.MustStart(baseDir) // check sdc.startErr / wrapped error before relying on targets\nif err != nil {\n\tlog.Errorf(\"http_sd init failed: %v\", err)\n}","preventionTips":["Verify all cert/key/token file paths exist and are readable before deploying the scrape config","Keep secret files mounted before the VictoriaMetrics process starts","Validate configs with vmagent -promscrape.configCheck"],"tags":["http","service-discovery","tls","configuration"],"backgroundTag":"http-client-init-failed","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}