basecamp/kamal · error · RuntimeError

Unknown secrets adapter: #{name}

Error message

Unknown secrets adapter: #{name}

What it means

kamal secrets fetch -a NAME resolves the adapter by camelizing NAME into a class under Kamal::Secrets::Adapters. Only four aliases are normalized (1password→one_password, lastpass→last_pass, gcp→gcp_secret_manager, bitwarden-sm→bitwarden_secrets_manager); any other name that does not match a shipped adapter class raises RuntimeError "Unknown secrets adapter" (rescued NameError from Object.const_get).

Source

Thrown at lib/kamal/secrets/adapters.rb:14

require "active_support/core_ext/string/inflections"
module Kamal::Secrets::Adapters
  def self.lookup(name)
    name = "one_password" if name.downcase == "1password"
    name = "last_pass" if name.downcase == "lastpass"
    name = "gcp_secret_manager" if name.downcase == "gcp"
    name = "bitwarden_secrets_manager" if name.downcase == "bitwarden-sm"
    adapter_class(name)
  end

  def self.adapter_class(name)
    Object.const_get("Kamal::Secrets::Adapters::#{name.camelize}").new
  rescue NameError => e
    raise RuntimeError, "Unknown secrets adapter: #{name}"
  end
end

View on GitHub (pinned to eee0083b38)

Solutions

1. Use the exact adapter name: one of aws_secrets_manager, bitwarden, bitwarden_secrets_manager, doppler, enpass, gcp_secret_manager, last_pass, one_password, passbolt (or the aliases 1password, lastpass, gcp, bitwarden-sm)
2. List what your installed version supports: ls of the kamal gem's lib/kamal/secrets/adapters directory, or check the docs for your Kamal version
3. If the adapter genuinely does not exist in your version, upgrade the kamal gem: gem install kamal / bundle update kamal

Example fix

# before
kamal secrets fetch -a aws RAILS_MASTER_KEY
# => Unknown secrets adapter: aws

# after
kamal secrets fetch -a aws_secrets_manager --account my-profile RAILS_MASTER_KEY

KNOWN_ADAPTERS = %w[
  aws_secrets_manager bitwarden bitwarden_secrets_manager doppler enpass
  gcp_secret_manager last_pass one_password passbolt test
  1password lastpass gcp bitwarden-sm
].freeze

abort "unknown secrets adapter #{ARGV[0]}" unless KNOWN_ADAPTERS.include?(ARGV[0])

def known_adapter?(name)
  %w[aws_secrets_manager bitwarden bitwarden_secrets_manager doppler enpass
     gcp_secret_manager last_pass one_password passbolt test
     1password lastpass gcp bitwarden-sm].include?(name)
end

When it happens

Trigger: Running kamal secrets fetch -a aws (no alias exists; must be aws_secrets_manager), -a op, -a vault, -a bitwarden when you meant bitwarden-sm, or any typo like one-password. Also raised when calling Kamal::Secrets::Adapters.lookup programmatically with an arbitrary string.

Common situations: Guessing short provider names instead of the exact snake_case class name; docs/examples using shorthand; new adapters referenced on an older installed Kamal version that does not ship the class.

Related errors

• Missing required option '--account'
• Could not read #{secrets} from AWS Secrets Manager
• Failed to login to and unlock Bitwarden
• Could not read #{item} from Bitwarden
• Item #{item} is not a login type item and no fields were spe

AI-assisted analysis of basecamp/kamal@eee0083b38 (2026-08-21). Data as JSON: /api/errors/04693499c67c8f18. Report an issue: GitHub.