{"record":{"id":"daab8f2773d08626","repo":"risingwavelabs/risingwave","slug":"secret-store-private-key-is-not-configured-daab8f","errorCode":null,"errorMessage":"secret_store_private_key is not configured","messagePattern":"secret_store_private_key is not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/meta/src/rpc/ddl_controller.rs","lineNumber":848,"sourceCode":"    ) -> MetaResult<NotificationVersion> {\n        let version = self\n            .metadata_manager\n            .catalog_controller\n            .alter_database_resource_group(database_id, resource_group)\n            .await?;\n\n        Ok(version)\n    }\n\n    // The 'secret' part of the request we receive from the frontend is in plaintext;\n    // here, we need to encrypt it before storing it in the catalog.\n    fn get_encrypted_payload(&self, secret: &Secret) -> MetaResult<Vec<u8>> {\n        let secret_store_private_key = self\n            .env\n            .opts\n            .secret_store_private_key\n            .clone()\n            .ok_or_else(|| anyhow!(\"secret_store_private_key is not configured\"))?;\n\n        let encrypted_payload = SecretEncryption::encrypt(\n            secret_store_private_key.as_slice(),\n            secret.get_value().as_slice(),\n        )\n        .context(format!(\"failed to encrypt secret {}\", secret.name))?;\n        Ok(encrypted_payload\n            .serialize()\n            .context(format!(\"failed to serialize secret {}\", secret.name))?)\n    }\n\n    async fn create_secret(&self, mut secret: Secret) -> MetaResult<NotificationVersion> {\n        // The 'secret' part of the request we receive from the frontend is in plaintext;\n        // here, we need to encrypt it before storing it in the catalog.\n        let secret_plain_payload = secret.value.clone();\n        let encrypted_payload = self.get_encrypted_payload(&secret)?;\n        secret.value = encrypted_payload;\n","sourceCodeStart":830,"sourceCodeEnd":866,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/meta/src/rpc/ddl_controller.rs#L830-L866","documentation":"Secrets in RisingWave are encrypted at rest with a cluster-wide private key (secret_store_private_key). get_encrypted_payload reads this key from meta node options before encrypting a secret value; if the option was never configured, encryption cannot proceed and the create/alter secret operation fails.","triggerScenarios":"Calling CREATE SECRET or ALTER SECRET when the meta node was started without secret_store_private_key in its configuration/opts.","commonSituations":"Deployments that never enabled the secret store feature attempting to use secrets; a config file copied between environments dropping the key; upgrading a cluster where the key was added to docs but not the actual meta opts.","solutions":["Add secret_store_private_key to the meta node configuration and restart the meta service.","Verify the key is present via risingwave.toml / meta opts before enabling secret workflows.","If the key was lost, restore it from backups — an existing encrypted store needs the same key to remain readable."],"exampleFix":"// before (risingwave.toml)\n[meta]\n# secret_store_private_key missing\n// after\n[meta]\nsecret_store_private_key = \"<base64-encoded-key>\"","handlingStrategy":"validation","validationCode":"// before CREATE SECRET, check config\nlet key = std::env::var(\"RW_SECRET_STORE_PRIVATE_KEY\")\n    .or(meta_opts.secret_store_private_key.clone());\nif key.is_none() { return Err(\"set secret_store_private_key in meta config first\".into()); }","typeGuard":null,"tryCatchPattern":"match create_secret(...).await {\n    Err(e) if e.to_string().contains(\"secret_store_private_key is not configured\") => configure_and_retry(),\n    other => other?,\n}","preventionTips":["Set secret_store_private_key in meta config at provisioning time","Validate meta opts at startup if secrets will be used","Back up the key — loss makes existing encrypted secrets unreadable"],"tags":["config","secrets","encryption"],"backgroundTag":"missing-config-value","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}