What causes "cannot find secret %s" in bytebase/bytebase?

Verify SecretName in the Bytebase config exactly matches a secret in the configured vault (az keyvault secret show --vault-name -n )

bytebase/bytebase · error

cannot find secret %s

Error message

cannot find secret %s

What it means

The Azure Key Vault GetSecret call returned a SecretNotFound error, meaning no secret (or no enabled version) exists at the given name in the vault. Bytebase detects the 'SecretNotFound' string and wraps it as 'cannot find secret %s'.

Source

Thrown at backend/component/secret/azure.go:42

	}

	// The URL should be the Key Vault URL (e.g., https://myvault.vault.azure.net/)
	vaultURL := externalSecret.Url
	if vaultURL == "" {
		return "", errors.New("missing Azure Key Vault URL")
	}

	client, err := azsecrets.NewClient(vaultURL, cred, nil)
	if err != nil {
		return "", errors.Wrapf(err, "failed to create Azure Key Vault client")
	}

	// Get the secret using the secret name.
	// Empty version string means get the latest version.
	resp, err := client.GetSecret(ctx, externalSecret.SecretName, "", nil)
	if err != nil {
		if strings.Contains(err.Error(), "SecretNotFound") {
			return "", errors.Wrapf(err, "cannot find secret %s", externalSecret.SecretName)
		}
		return "", errors.Wrapf(err, "failed to get Azure Key Vault secret %s", externalSecret.SecretName)
	}

	if resp.Value == nil {
		return "", errors.Errorf("empty secret value for %s", externalSecret.SecretName)
	}

	return *resp.Value, nil
}

View on GitHub (pinned to 1870550677)

Solutions

Verify SecretName in the Bytebase config exactly matches a secret in the configured vault (az keyvault secret show --vault-name <vault> -n <name>)
Check the secret is enabled and not deleted/purged in Key Vault
Confirm the vault URL points at the vault that actually contains the secret
Ensure the managed identity / service principal has Key Vault Secrets User (get) RBAC on the vault

Example fix

// before
SecretName: "DbPassword" // Key Vault names are lowercase
// after
SecretName: "db-password"

Defensive patterns

Strategy: validation

Validate before calling

// run before configuring:
az keyvault secret show --vault-name <vault> --name <SecretName>
// non-zero exit / 'Secret not found' means the name or vault is wrong

Try / catch

if strings.Contains(err.Error(), "SecretNotFound") {
	return fmt.Errorf("secret %q not found in vault %s; verify name (lowercase, no underscores), vault URL, and that the secret is enabled", name, vaultURL)
}

Prevention

Use lowercase names with hyphens — Key Vault forbids uppercase and underscores
Validate the secret exists via az CLI or a GetSecret probe when saving settings
Pin the vault URL and secret name together in one reviewed config source
Enable Key Vault soft-delete so accidental deletions are recoverable

When it happens

Trigger: client.GetSecret(ctx, externalSecret.SecretName, "", nil) returns an error containing 'SecretNotFound' in getSecretFromAzure — the SecretName in the Bytebase config does not match a secret in the vault pointed to by Url.

Common situations: Typo in the secret name; secret deleted or disabled in Key Vault; secret exists in a different vault than the configured vault URL; name casing mismatch (Key Vault names are lowercase, hyphens allowed); RBAC grants exist but the secret itself was purged.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/8e8f4e3b4be92238. Report an issue: GitHub.