iflytek/astron-agent · error

TENANT_KEY and TENANT_SECRET must be distinct values

Error message

TENANT_KEY and TENANT_SECRET must be distinct values

What it means

Validate() in the tenant bootstrap credential loader rejects configurations where TENANT_KEY and TENANT_SECRET hold the identical string. These must be two distinct values (an identifier and a secret); reusing one value for both defeats the credential scheme and indicates a misconfiguration.

Solutions

1. Generate and assign two distinct values for TENANT_KEY and TENANT_SECRET
2. Check the Kubernetes Secret / env template that rendered both fields and fix the duplicate value
3. Redeploy/restart the tenant service so the corrected credentials are reloaded and validated

Example fix

# before
TENANT_KEY=s3cr3tvalue
TENANT_SECRET=s3cr3tvalue
# after
TENANT_KEY=tenant-admin-key-9f2a
TENANT_SECRET=s3cr3tvalue-7d41

key := os.Getenv("TENANT_KEY")
secret := os.Getenv("TENANT_SECRET")
if key == "" || secret == "" {
    return errors.New("TENANT_KEY and TENANT_SECRET must both be set")
}
if key == secret {
    return errors.New("TENANT_KEY and TENANT_SECRET must be distinct")
}

creds, err := config.LoadTenantBootstrapCredentials(ctx)
if err != nil {
    if strings.Contains(err.Error(), "must be distinct") {
        logger.Fatal("fix deployment secret: TENANT_KEY equals TENANT_SECRET")
    }
    return err
}

When it happens

Trigger: LoadTenantBootstrapCredentials / reconcileTenantBootstrap / parseMysqlConfig call Validate, and credentials.APIKey == credentials.Secret after loading from env vars (TENANT_KEY, TENANT_SECRET) or credential files.

Common situations: Operator set both env vars to the same generated password, a secrets template rendered the same value into both files, or a copy-paste during manual secret creation in a deployment manifest.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• TENANT_ID must remain
• S3_PRESIGN_ERROR
• Remote resource URL must not include user information
• CODE_EXEC_TIMEOUT_SEC must be between
• CODE_EXEC_MEMORY_LIMIT_MB must be between

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/d55ed79c004220f6. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/config/bootstrap_credentials.go:76

}

// Validate enforces the storage and HTTP-header constraints shared by every
// bootstrap credential consumer.
func (credentials TenantBootstrapCredentials) Validate() error {
	if credentials.TenantID != BootstrapTenantID {
		return fmt.Errorf(
			"TENANT_ID must remain %s because persisted bootstrap data refers to it",
			BootstrapTenantID,
		)
	}
	if err := validateCredential("TENANT_KEY", credentials.APIKey); err != nil {
		return err
	}
	if err := validateCredential("TENANT_SECRET", credentials.Secret); err != nil {
		return err
	}
	if credentials.APIKey == credentials.Secret {
		return errors.New("TENANT_KEY and TENANT_SECRET must be distinct values")
	}
	if credentials.APIKey == LegacyTenantKey || credentials.Secret == LegacyTenantSecret {
		return errors.New("published legacy tenant credentials cannot be used")
	}
	return nil
}

func credentialFromEnvironmentOrFile(valueEnvironment, fileEnvironment string) (string, error) {
	if value := strings.TrimSpace(os.Getenv(valueEnvironment)); value != "" {
		if err := validateCredential(valueEnvironment, value); err != nil {
			return "", err
		}
		return value, nil
	}

	fileName := strings.TrimSpace(os.Getenv(fileEnvironment))
	if fileName == "" {
		return "", fmt.Errorf("%s or %s is required", valueEnvironment, fileEnvironment)

View on GitHub (pinned to 5e758547a8)