risingwavelabs/risingwave · error · ConnectorError

`enable_config_load` can't be enabled in this environment

Error message

`enable_config_load` can't be enabled in this environment

What it means

Raised in `IcebergConnection::validate_connection` when the environment sets the `DISABLE_DEFAULT_CREDENTIAL` variable (e.g. hosted/managed deployments that forbid implicit credentials) and the connection nevertheless sets `enable_config_load = true`. This option would let OpenDAL load credentials from default config files, which the deployment policy disallows.

Source

Thrown at src/connector/src/connector_common/connection.rs:268

                        builder = builder.account_key(azblob_account_key);
                    }
                    if let Some(azblob_endpoint_url) = &common.azblob_endpoint_url {
                        builder = builder.endpoint(azblob_endpoint_url);
                    }
                    builder = builder.root(root.as_str()).container(bucket.as_str());
                    let op = Operator::new(builder)?;
                    op.check().await?;
                }
                _ => {
                    bail!("Unsupported scheme: {}", scheme);
                }
            }
        }

        if env_var_is_true(DISABLE_DEFAULT_CREDENTIAL)
            && matches!(common.enable_config_load, Some(true))
        {
            bail!("`enable_config_load` can't be enabled in this environment");
        }

        if common.hosted_catalog.unwrap_or(false) {
            // If `hosted_catalog` is set, we don't need to test the catalog, but just ensure no catalog fields are set.
            if common.catalog_type.is_some() {
                bail!("`catalog.type` must not be set when `hosted_catalog` is set");
            }
            if common.catalog_uri.is_some() {
                bail!("`catalog.uri` must not be set when `hosted_catalog` is set");
            }
            if common.catalog_name.is_some() {
                bail!("`catalog.name` must not be set when `hosted_catalog` is set");
            }
            if self.jdbc_user.is_some() {
                bail!("`catalog.jdbc.user` must not be set when `hosted_catalog` is set");
            }
            if self.jdbc_password.is_some() {
                bail!("`catalog.jdbc.password` must not be set when `hosted_catalog` is set");

View on GitHub (pinned to 6469eb736d)

Solutions

1. Remove `enable_config_load = true` from the connection options.
2. Provide explicit credentials instead (e.g. `s3.access.key`/`s3.secret.key` or `gcs.credential`).
3. If you truly need config-file loading, run in an environment where `DISABLE_DEFAULT_CREDENTIAL` is not set.

Example fix

// before
WITH (connector='iceberg', warehouse.path='s3://b/w', enable_config_load=true)
// after
WITH (connector='iceberg', warehouse.path='s3://b/w', s3.access.key='...', s3.secret.key='...')

if std::env::var("DISABLE_DEFAULT_CREDENTIAL").map(|v| v == "true").unwrap_or(false)
    && opts.contains_key("enable_config_load") { return Err("enable_config_load not allowed here"); }

if let Err(e) = conn.validate_connection().await {
    if e.to_string().contains("enable_config_load") {
        log::warn("environment forbids default credential loading; provide explicit credentials");
    }
    return Err(e.into());
}

When it happens

Trigger: Calling validate_connection on an Iceberg connection where both: the environment variable `DISABLE_DEFAULT_CREDENTIAL` is truthy, and `enable_config_load` is explicitly Some(true) in the connection options.

Common situations: Running in a managed/hosted RisingWave environment that disables default credential loading, while a connection config copied from a self-hosted setup still contains `enable_config_load=true`.

Related errors

• adlsgen2.authority_host must use the https scheme, got {}
• adlsgen2.authority_host must not contain userinfo
• invalid write_mode: {}, must be one of: {}, {}
• invalid compaction_type: {}, must be one of: {}, {}, {}, {}
• 'copy-on-write' mode is not supported for append-only iceber

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/54a5f6e5dc1ba7d5. Report an issue: GitHub.