juicedata/juicefs · error

secret was removed; please correct it with `config` command

Error message

secret was removed; please correct it with `config` command

What it means

Returned by Format.Decrypt() in pkg/meta/config.go when a secret field (EncryptKey etc.) has the literal value 'removed'. JuiceFS's `config` command rewrites the format with secrets replaced by the string 'removed' before persisting them encrypted; encountering 'removed' means the field was never re-encrypted and the metadata record lost the secret.

Source

Thrown at pkg/meta/config.go:277

	f.KeyEncrypted = true
	return nil
}

func (f *Format) Decrypt() error {
	if !f.KeyEncrypted {
		return nil
	}

	ci, err := newCipher(f.EncryptAlgo, f.UUID)
	if err != nil {
		return err
	}
	decrypt := func(k *string) {
		if *k == "" {
			return
		}
		if *k == "removed" {
			err = fmt.Errorf("secret was removed; please correct it with `config` command")
			return
		}
		buf, e := base64.StdEncoding.DecodeString(*k)
		if e != nil {
			err = fmt.Errorf("decode key: %s", e)
			return
		}
		plaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)
		if e != nil {
			err = fmt.Errorf("open cipher: %s", e)
			return
		}
		*k = string(plaintext)
	}

	decrypt(&f.EncryptKey)
	decrypt(&f.SecretKey)
	decrypt(&f.SessionToken)

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Re-run `juicefs config <META-URL> --encrypt-key <key>` (or set the relevant secret) to write a correct encrypted value
2. Restore the secret from a backup or dump taken before it was scrubbed
3. If the key is truly lost, the encrypted data is unrecoverable; re-format and reload data

// before decrypting
if format.EncryptKey == "removed" { return errors.New("secret was scrubbed; re-set it via juicefs config --encrypt-key") }

When it happens

Trigger: Loading a volume format whose encrypted secret field equals the sentinel string 'removed' and calling Format.Decrypt() on it — e.g. metadata that was dumped/config-edited and reloaded without the secret being restored.

Common situations: Manually editing metadata or restoring a backup where secrets were scrubbed; running `juicefs config` partially and failing to update the secret; mixing volumes across environments.

Related errors

• format decrypt: %s
• %w: please set the 'JFS_RSA_PASSPHRASE' environment variable
• create %sor: %w
• decrypt format: %s
• encrypt format: %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/eb027fae5785a34e. Report an issue: GitHub.