dapr/dapr · error

secret store %q not found

Error message

secret store %q not found

What it means

Thrown by ComponentStore.GetSecret (pkg/runtime/compstore/secretstore.go:64) when no secret store component with the given name is registered in the runtime's component store. Dapr only registers secret stores whose component YAML loaded successfully during init, so this is a pure lookup failure: the request never reached any secrets backend. It means the store name is unknown to the process, not that the secret is missing.

Source

Thrown at pkg/runtime/compstore/secretstore.go:64

func (c *ComponentStore) DeleteSecretStore(name string) {
	c.lock.Lock()
	defer c.lock.Unlock()

	delete(c.secrets, name)
}

func (c *ComponentStore) SecretStoresLen() int {
	c.lock.RLock()
	defer c.lock.RUnlock()

	return len(c.secrets)
}

func (c *ComponentStore) GetSecret(ctx context.Context, storeName, secretName, secretKey string) (string, error) {
	store, ok := c.GetSecretStore(storeName)
	if !ok {
		return "", fmt.Errorf("secret store %q not found", storeName)
	}
	resp, err := store.GetSecret(ctx, secretstores.GetSecretRequest{Name: secretName})
	if err != nil {
		return "", fmt.Errorf("failed to get secret %q from store %q: %w", secretName, storeName, err)
	}
	val, ok := resp.Data[secretKey]
	if !ok {
		return "", fmt.Errorf("key %q not found in secret %q (store: %q)", secretKey, secretName, storeName)
	}
	return val, nil
}

View on GitHub (pinned to 74ad417027)

Solutions

1. List the loaded components (`dapr components -k` or inspect the components dir) and verify the secret store's metadata.name matches the requested storeName exactly
2. Check daprd startup logs for an init error on that secret store component and fix the component spec/auth so it loads
3. Add the missing SecretStore component YAML to the components directory (or apply the k8s Component resource) and restart the sidecar
4. Fix the referencing component/configuration so the store name matches the registered name (no typos, no namespace prefix in standalone mode)

Example fix

# before (component references a wrong store name)
spec:
  type: state.redis
  metadata:
  - name: redisPassword
    secretKeyRef:
      name: redis-secret
      key: password
      secretStore: keyvaultx   # no such store registered

# after
      secretStore: keyvault    # matches metadata.name of the loaded SecretStore

if _, ok := compStore.GetSecretStore(storeName); !ok {
	return fmt.Errorf("skip: secret store %q is not loaded; check components", storeName)
}
val, err := compStore.GetSecret(ctx, storeName, secretName, secretKey)

func hasSecretStore(c *compstore.ComponentStore, name string) bool {
	_, ok := c.GetSecretStore(name)
	return ok
}

When it happens

Trigger: Calling compstore.GetSecret(ctx, "myvault", secret, key) when no component with metadata.name == "myvault" and kind SecretStore was loaded, or when that component's Init failed so it was never added to c.secrets via AddSecretStore.

Common situations: A component's secretstores.secretstoreRef (or secretKeyRef) names a store that does not exist; the SecretStore YAML is missing from --components-path; the component failed auth/spec validation at startup; in Kubernetes the Component lives in a different namespace than the one the sidecar watches.

Related errors

• couldn't find input binding %s/%s
• couldn't find output binding %s/%s
• key %q not found in secret %q (store: %q)
• detected duplicate actor state store: %s and %s
• cannot use --etcd-client-endpoints with --etcd-embed

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/1a741e24476f4433. Report an issue: GitHub.