iflytek/astron-agent · error

database password is required

Error message

database password is required

What it means

Config.Validate requires DataBase.Password to be non-empty; this error means the database password was never supplied, so the service refuses to start rather than attempt an unauthenticated DB connection. Sources are the TOML `[database] password` key and the DATABASE_PASSWORD env var.

Solutions

1. Set DATABASE_PASSWORD in the environment, ideally via a Secret (DATABASE_PASSWORD=<secret>).
2. Add `password = "..."` under the [database] section of the TOML config file (avoid committing real secrets).
3. Verify the Secret/ConfigMap mounting and that the key name inside it is exactly DATABASE_PASSWORD.
4. If using *_FILE style injection, note this loader only reads direct env vars — export the value into DATABASE_PASSWORD in the entrypoint.

Example fix

// before: deployment env
//   DATABASE_USERNAME: tenant
// after: add password from secret
//   DATABASE_USERNAME: tenant
//   DATABASE_PASSWORD:
//     valueFrom:
//       secretKeyRef: {name: tenant-db, key: password}

if os.Getenv("DATABASE_PASSWORD") == "" {
	return errors.New("DATABASE_PASSWORD must be set (via Secret) before tenant startup")
}

cfg, err := config.LoadConfig(path)
if err != nil {
	if strings.Contains(err.Error(), "database password is required") {
		log.Fatalf("DATABASE_PASSWORD missing — check secretKeyRef: %v", err)
	}
	return err
}

When it happens

Trigger: LoadConfig(path) -> Config.Validate() returns this when `[database] password` is absent in the TOML and DATABASE_PASSWORD is unset/empty.

Common situations: K8s Secret not injected into the pod (envFrom missing), secret key mismatch (DB_PASSWORD vs DATABASE_PASSWORD), intentionally blank password in dev config, or credential rotation removing the var from the manifest.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• must contain only ASCII letters, digits, '.', '_', '~', or
• database type is required
• database username is required
• database url is required
• invalid DATABASE_MAX_OPEN_CONNS

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/ef083862ea99058c. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/config/config.go:45

	TenantBootstrap TenantBootstrapCredentials
}

func (c *Config) String() string {
	return fmt.Sprintf("Config{Server: %v, DataBase: %v, Log: %v}", c.Server, c.DataBase, c.Log)
}

func (c *Config) Validate() error {
	if c.Server.Port == 0 {
		return fmt.Errorf("server port is required")
	}
	if c.DataBase.DBType == "" {
		return fmt.Errorf("database type is required")
	}
	if c.DataBase.UserName == "" {
		return fmt.Errorf("database username is required")
	}
	if c.DataBase.Password == "" {
		return fmt.Errorf("database password is required")
	}
	if c.DataBase.Url == "" {
		return fmt.Errorf("database url is required")
	}
	if c.Log.LogFile == "" {
		return fmt.Errorf("log file is required")
	}
	return nil
}

func LoadConfig(path string) (*Config, error) {
	cfg := &Config{}
	// load config from local file
	localLoader := NewLocalLoader(path)
	if err := localLoader.Load(cfg); err != nil {
		fmt.Printf("failed to load config from file: %v\n", err)
	}
	// load config from environment variables

View on GitHub (pinned to 5e758547a8)