Server secret not set, hulylake storage adapter initialized

Error message

Server secret not set, hulylake storage adapter initialized with default secret

What it means

The Hulylake storage adapter constructor checks the server secret in server token metadata; if undefined it warns that tokens will be generated with a default secret. Like the datalake adapter, this weakens token signing security and can cause authentication mismatches against the storage backend.

Source

Thrown at foundations/server/packages/hulylake/src/index.ts:78

  retryCount?: number
  retryInterval?: number
}

/**
 * @public
 */
export class HulylakeService implements StorageAdapter {
  private readonly client: HulylakeClient
  private readonly retryCount: number
  private readonly retryInterval: number

  constructor (
    readonly cfg: HulylakeConfig,
    readonly options: HulylakeClientOptions = {}
  ) {
    const secret = getMetadata(serverToken.metadata.Secret)
    if (secret === undefined) {
      console.warn('Server secret not set, hulylake storage adapter initialized with default secret')
    }
    const token = generateToken(systemAccountUuid, undefined)
    this.client = createHulylakeClient(cfg, token)
    this.retryCount = options.retryCount ?? 5
    this.retryInterval = options.retryInterval ?? 50
  }

  async initialize (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {}

  async close (): Promise<void> {}

  async exists (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<boolean> {
    // workspace/buckets not supported, assume that always exist
    return true
  }

  @withContext('make')
  async make (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {

View on GitHub (pinned to 63e28dc964)

Solutions

Set the server secret env/config value before initializing the hulylake adapter
Restart the service so the new secret is picked up in token metadata
Add a fail-fast startup assertion for the secret in production environments
Rotate/reissue any tokens created under the default secret

Example fix

// before (k8s container spec)
env: []
// after
env:
  - name: SERVER_SECRET
    valueFrom:
      secretKeyRef: { name: hcserver, key: secret }

Defensive patterns

Strategy: validation

Validate before calling

if (process.env.SERVER_SECRET === undefined) {
  throw new Error('SERVER_SECRET must be set before initializing hulylake adapter')
}

Type guard

function hasServerSecret(meta: { Secret?: string }): meta is { Secret: string } {
  return typeof meta.Secret === 'string' && meta.Secret.length > 0
}

Try / catch

try {
  const adapter = new HulylakeStorageAdapter(cfg)
  if (adapter.initializedWithDefaultSecret) logger.error('hulylake using default secret — refusing in production')
} catch (err) {
  logger.error('hulylake init failed', { err })
  process.exit(1)
}

Prevention

Fail fast at boot if the server secret is unset in production
Mount the secret via your platform's secret manager
Keep datalake and hulylake deployments sharing the same secret configuration checks
Rotate credentials after any period running on the default secret

When it happens

Trigger: Constructing the Hulylake storage adapter in a process where the server secret (serverToken.metadata.Secret) is not configured in the environment.

Common situations: Missing SERVER_SECRET in deployment env; local dev setup without secrets file; Kubernetes secret not mounted; renamed env var across versions.

Related errors

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/54f205f9bc407d69. Report an issue: GitHub.