{"record":{"id":"eb027fae5785a34e","repo":"juicedata/juicefs","slug":"secret-was-removed-please-correct-it-with-config","errorCode":null,"errorMessage":"secret was removed; please correct it with `config` command","messagePattern":"secret was removed; please correct it with `config` command","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":277,"sourceCode":"\tf.KeyEncrypted = true\n\treturn nil\n}\n\nfunc (f *Format) Decrypt() error {\n\tif !f.KeyEncrypted {\n\t\treturn nil\n\t}\n\n\tci, err := newCipher(f.EncryptAlgo, f.UUID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdecrypt := func(k *string) {\n\t\tif *k == \"\" {\n\t\t\treturn\n\t\t}\n\t\tif *k == \"removed\" {\n\t\t\terr = fmt.Errorf(\"secret was removed; please correct it with `config` command\")\n\t\t\treturn\n\t\t}\n\t\tbuf, e := base64.StdEncoding.DecodeString(*k)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"decode key: %s\", e)\n\t\t\treturn\n\t\t}\n\t\tplaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"open cipher: %s\", e)\n\t\t\treturn\n\t\t}\n\t\t*k = string(plaintext)\n\t}\n\n\tdecrypt(&f.EncryptKey)\n\tdecrypt(&f.SecretKey)\n\tdecrypt(&f.SessionToken)","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L259-L295","documentation":"Returned by Format.Decrypt() in pkg/meta/config.go when a secret field (EncryptKey etc.) has the literal value 'removed'. JuiceFS's `config` command rewrites the format with secrets replaced by the string 'removed' before persisting them encrypted; encountering 'removed' means the field was never re-encrypted and the metadata record lost the secret.","triggerScenarios":"Loading a volume format whose encrypted secret field equals the sentinel string 'removed' and calling Format.Decrypt() on it — e.g. metadata that was dumped/config-edited and reloaded without the secret being restored.","commonSituations":"Manually editing metadata or restoring a backup where secrets were scrubbed; running `juicefs config` partially and failing to update the secret; mixing volumes across environments.","solutions":["Re-run `juicefs config <META-URL> --encrypt-key <key>` (or set the relevant secret) to write a correct encrypted value","Restore the secret from a backup or dump taken before it was scrubbed","If the key is truly lost, the encrypted data is unrecoverable; re-format and reload data"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before decrypting\nif format.EncryptKey == \"removed\" { return errors.New(\"secret was scrubbed; re-set it via juicefs config --encrypt-key\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never persist formats after `config` has scrubbed secrets without re-setting them","Keep an out-of-band copy of encryption keys","Restore secrets immediately after loading dumps or backups"],"tags":["config","encryption","secret-removed"],"backgroundTag":"missing-credentials","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}