{"record":{"id":"b4793a4ced766487","repo":"conductor-oss/conductor","slug":"secrets-are-disabled","errorCode":null,"errorMessage":"secrets are disabled","messagePattern":"secrets are disabled","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"warning","filePath":"core/src/main/java/com/netflix/conductor/core/secrets/NoopSecretsDAO.java","lineNumber":44,"sourceCode":"\n    @Override\n    public String getSecret(String name) {\n        return null;\n    }\n\n    @Override\n    public boolean secretExists(String name) {\n        return false;\n    }\n\n    @Override\n    public List<String> listSecretNames() {\n        return Collections.emptyList();\n    }\n\n    @Override\n    public void putSecret(String name, String value) {\n        throw new UnsupportedOperationException(\"secrets are disabled\");\n    }\n\n    @Override\n    public void deleteSecret(String name) {\n        throw new UnsupportedOperationException(\"secrets are disabled\");\n    }\n\n    @Override\n    public List<CredentialMeta> listWithMeta() {\n        return List.of();\n    }\n}\n","sourceCodeStart":26,"sourceCodeEnd":57,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/core/src/main/java/com/netflix/conductor/core/secrets/NoopSecretsDAO.java#L26-L57","documentation":"Thrown by NoopSecretsDAO.putSecret when secrets functionality is entirely disabled (conductor.secrets.type=noop). The noop DAO returns null/empty for all reads and throws UnsupportedOperationException for all write operations. This means the secrets subsystem is intentionally turned off — no secrets can be stored, retrieved, or managed.","triggerScenarios":"Calling the secrets API endpoint (POST /api/secrets/{name}) or any code path that invokes SecretsDAO.putSecret while 'conductor.secrets.type' is explicitly set to 'noop'. This is an opt-in configuration — the default is 'env', not 'noop'.","commonSituations":"A deployment explicitly disables secrets for testing or minimal-footprint environments by setting conductor.secrets.type=noop, but an application component or workflow still tries to write a secret. Misconfiguration where noop was intended for dev but leaked into a staging/prod profile.","solutions":["Change conductor.secrets.type from 'noop' to a functional backend ('env' for read-only env vars, or a writable backend like 'database').","Remove or disable the code path that attempts to write secrets if secrets are intentionally not used in this deployment.","If using noop for testing, mock or stub the secrets-writing code path in test configuration."],"exampleFix":"# before — secrets disabled\n# application.properties\nconductor.secrets.type=noop\n\n# after — enable env-backed secrets (default)\nconductor.secrets.type=env\n# or use a database-backed implementation for full read/write support","handlingStrategy":"type-guard","validationCode":"// Check secrets backend type before attempting write\nif (secretsDAO instanceof NoopSecretsDAO) {\n    throw new IllegalStateException(\n        \"Secrets are disabled (conductor.secrets.type=noop). \"\n            + \"Set conductor.secrets.type=env or a writable backend.\");\n}\nsecretsDAO.putSecret(name, value);","typeGuard":"public boolean isSecretsEnabled(SecretsDAO dao) {\n    return !(dao instanceof NoopSecretsDAO);\n}","tryCatchPattern":"try {\n    secretsDAO.putSecret(name, value);\n} catch (UnsupportedOperationException e) {\n    if (\"secrets are disabled\".equals(e.getMessage())) {\n        throw new IllegalStateException(\n            \"Secrets subsystem is disabled. Enable it via conductor.secrets.type.\", e);\n    }\n    throw e;\n}","preventionTips":["Set conductor.secrets.type to a functional value ('env' for read-only, or a writable backend) if secrets are needed.","Do not set conductor.secrets.type=noop in environments where secrets management is expected.","Add a health check that warns if secrets are disabled but secret-referencing workflows are deployed."],"tags":["secrets","noop","disabled","configuration"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}