{"record":{"id":"e440c68ee375e831","repo":"VictoriaMetrics/VictoriaMetrics","slug":"applicationcredentialsecret-is-empty","errorCode":null,"errorMessage":"ApplicationCredentialSecret is empty","messagePattern":"ApplicationCredentialSecret is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/openstack/auth.go","lineNumber":111,"sourceCode":"\t\tIdentity identityReq    `json:\"identity\"`\n\t\tScope    map[string]any `json:\"scope,omitempty\"`\n\t}\n\ttype request struct {\n\t\tAuth authReq `json:\"auth\"`\n\t}\n\n\t// Populate the request structure based on the provided arguments. Create and return an error\n\t// if insufficient or incompatible information is present.\n\tvar req request\n\n\tif sdc.Password == nil {\n\t\t// There are three kinds of possible application_credential requests\n\t\t// 1. application_credential id + secret\n\t\t// 2. application_credential name + secret + user_id\n\t\t// 3. application_credential name + secret + username + domain_id / domain_name\n\t\tif len(sdc.ApplicationCredentialID) > 0 {\n\t\t\tif sdc.ApplicationCredentialSecret == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"ApplicationCredentialSecret is empty\")\n\t\t\t}\n\t\t\treq.Auth.Identity.Methods = []string{\"application_credential\"}\n\t\t\tsecret := sdc.ApplicationCredentialSecret.String()\n\t\t\treq.Auth.Identity.ApplicationCredential = &applicationCredentialReq{\n\t\t\t\tID:     &sdc.ApplicationCredentialID,\n\t\t\t\tSecret: &secret,\n\t\t\t}\n\t\t\treturn json.Marshal(req)\n\t\t}\n\n\t\tif sdc.ApplicationCredentialSecret == nil {\n\t\t\treturn nil, fmt.Errorf(\"missing application_credential_secret when application_credential_name is set\")\n\t\t}\n\t\tvar userRequest *userReq\n\t\tif len(sdc.UserID) > 0 {\n\t\t\t// UserID could be used without the domain information\n\t\t\tuserRequest = &userReq{\n\t\t\t\tID: &sdc.UserID,","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/openstack/auth.go#L93-L129","documentation":"Thrown when application_credential_id is set but application_credential_secret is nil. Keystone's application_credential auth with an ID always requires the matching secret, so buildAuthRequestBody refuses to build a partial auth request. It is a config-completeness check, not a network failure.","triggerScenarios":"openstack_sd_config with application_credential_id set and password unset, but application_credential_secret omitted or empty. Raised from buildAuthRequestBody at SD config initialization.","commonSituations":"Secret stored in a file but the file provider block forgotten; secret rotation removed the entry; user assumed the ID alone identifies the credential.","solutions":["Set application_credential_secret (or its file-based variant) alongside application_credential_id.","Verify the secret file exists and is readable by the VictoriaMetrics process if using a file provider.","If the credential has no secret, use password auth with username/user_id instead."],"exampleFix":"# before\nopenstack_sd_configs:\n  - application_credential_id: 8a7c3f...\n# after\nopenstack_sd_configs:\n  - application_credential_id: 8a7c3f...\n    application_credential_secret: <secret>","handlingStrategy":"validation","validationCode":"if len(cfg.ApplicationCredentialID) > 0 && cfg.ApplicationCredentialSecret == nil {\n    return fmt.Errorf(\"application_credential_id set but application_credential_secret is empty\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat (id, secret) as an atomic pair; define them adjacently in YAML.","Check secret file permissions/readability when using file providers.","Rotate secrets by editing the pair together."],"tags":["openstack","config","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}