What causes "error reading ACL secret key from file: %s: %s" in dgraph-io/dgraph?

Verify the file exists at the exact path and is readable by the process user (ls -l, cat as the service user)

error reading ACL secret key from file: %s: %s

Error message

error reading ACL secret key from file: %s: %s

What it means

After resolving the ACL secret key file path from the superflag, GetEncAclKeys reads it with os.ReadFile. This error wraps the OS failure when the file cannot be read (missing, unreadable permissions, or a directory).

Source

Thrown at x/acl_enc_keys.go:66

			return nil, fmt.Errorf("flags: Encryption key set in both vault and encryption flags")
		}
		var err error
		if encKey, err = os.ReadFile(encKeyFile); err != nil {
			return nil, fmt.Errorf("error reading encryption key from file: %s: %s", encKeyFile, err)
		}
	}
	if l := len(encKey); encKey != nil && l != 16 && l != 32 && l != 64 {
		return nil, fmt.Errorf("encryption key must have length of 16, 32, or 64 bytes, got %d bytes instead", l)
	}

	aclSecretFile := aclSuperFlag.GetPath(flagAclKeyFile)
	if aclSecretFile != "" {
		if aclKey != nil {
			return nil, fmt.Errorf("flags: ACL secret key set in both vault and acl flags")
		}
		var err error
		if aclKey, err = os.ReadFile(aclSecretFile); err != nil {
			return nil, fmt.Errorf("error reading ACL secret key from file: %s: %s", aclSecretFile, err)
		}
	}

	keys := &Keys{
		AclSecretKeyBytes: aclKey,
		AclAccessTtl:      aclSuperFlag.GetDuration(flagAclAccessTtl),
		AclRefreshTtl:     aclSuperFlag.GetDuration(flagAclRefreshTtl),
		EncKey:            encKey,
	}

	if aclKey != nil {
		algStr := aclSuperFlag.GetString(flagAclJwtAlg)
		aclAlg := jwt.GetSigningMethod(algStr)
		if aclAlg == nil {
			return nil, fmt.Errorf("Unsupported JWT signing algorithm for ACL: %v", algStr)
		}
		if err := checkAclKeyLength(aclAlg, aclKey); err != nil {
			return nil, err

View on GitHub (pinned to 759e242be6)

Solutions

Verify the file exists at the exact path and is readable by the process user (ls -l, cat as the service user)
Fix mount configuration so the Kubernetes/Docker secret is present before process start
Use an absolute path instead of a path relative to the working directory
Check the wrapped OS error in the message for the concrete cause (no such file, permission denied)

Example fix

// before
--acl "hmac-secret-file=./acl_key" # relative, file not there
// after
--acl "hmac-secret-file=/dgraph/acl/acl_key" # absolute, verified readable

Defensive patterns

Strategy: validation

Validate before calling

if path := aclSuperFlag.GetPath(flagAclKeyFile); path != "" {
    fi, err := os.Stat(path)
    if err != nil { return fmt.Errorf("ACL key file inaccessible: %w", err) }
    if fi.IsDir() { return fmt.Errorf("ACL key file is a directory: %s", path) }
    if _, err := os.ReadFile(path); err != nil { return fmt.Errorf("ACL key file unreadable: %w", err) }
}

Try / catch

if _, err := x.GetEncAclKeys(flag, encKey); err != nil {
    var pe *os.PathError
    if errors.As(err, &pe) {
        log.Fatalf("check ACL key file %s: %v", pe.Path, pe.Err)
    }
    return err
}

Prevention

Mount secrets before the process starts (init containers / depends_on)
Use absolute paths in container deployments
Verify the process user has read permission on the key file
Check the wrapped os error in the message for the root cause

When it happens

Trigger: Calling GetEncAclKeys with flagAclKeyFile set to a path that does not exist, has insufficient permissions, is a directory, or was deleted/mounted-empty at runtime.

Common situations: Kubernetes secret not mounted at the expected path; wrong relative path because the binary runs from a different working directory; file permissions changed by a container image update; secret file not yet mounted when the process starts.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/63d1895a2d33fd63. Report an issue: GitHub.