risingwavelabs/risingwave · error

No auth method specified for Vault backend

Error message

No auth method specified for Vault backend

What it means

HashiCorpVaultConfig::from_protobuf requires an authentication method to construct a usable Vault client configuration. When the protobuf secret definition carries no auth payload (neither AppRole nor any other auth variant), the builder cannot produce credentials and aborts with this error. Vault always requires some auth mechanism, so a config without one is unusable.

Source

Thrown at src/common/secret/src/vault_client.rs:124

}

impl HashiCorpVaultConfig {
    /// Convert from protobuf `SecretHashicorpVaultBackend` to `HashiCorpVaultConfig`
    pub fn from_protobuf(vault_backend: &secret::SecretHashicorpVaultBackend) -> Result<Self> {
        let auth = match vault_backend.auth.as_ref() {
            Some(secret::secret_hashicorp_vault_backend::Auth::TokenAuth(token_auth)) => {
                HashiCorpVaultAuth::Token {
                    auth_token: token_auth.token.clone(),
                }
            }
            Some(secret::secret_hashicorp_vault_backend::Auth::ApproleAuth(approle_auth)) => {
                HashiCorpVaultAuth::AppRole {
                    auth_role_id: approle_auth.role_id.clone(),
                    auth_secret_id: approle_auth.secret_id.clone(),
                }
            }
            None => {
                return Err(anyhow::anyhow!(
                    "No auth method specified for Vault backend"
                ));
            }
        };

        Ok(HashiCorpVaultConfig {
            addr: vault_backend.addr.clone(),
            path: vault_backend.path.clone(),
            field: vault_backend.field.clone(),
            auth,
            tls_skip_verify: vault_backend.tls_skip_verify,
        })
    }

    /// Convert `HashiCorpVaultConfig` to protobuf `SecretHashicorpVaultBackend`
    pub fn to_protobuf(&self) -> secret::SecretHashicorpVaultBackend {
        let auth = match &self.auth {
            HashiCorpVaultAuth::Token { auth_token } => Some(

View on GitHub (pinned to 6469eb736d)

Solutions

1. Add the Vault authentication configuration (e.g. APPROLE with role_id and secret_id) to the CREATE SECRET statement and retry
2. Inspect the protobuf payload being passed to from_protobuf and confirm the auth oneof is populated
3. Check client/tooling version to ensure it emits the auth field in the secret proto

Example fix

// before
CREATE SECRET s1 WITH (backend='hashicorp_vault', url='https://vault:8200');
// after
CREATE SECRET s1 WITH (backend='hashicorp_vault', url='https://vault:8200', approle_auth='{"role_id":"xxx","secret_id":"yyy"}');

fn validate_vault_config(proto: &SecretProto) -> Result<(), String> {
    if proto.auth.is_none() {
        return Err("Vault backend requires an auth method (e.g. approle_auth with role_id and secret_id)".into());
    }
    Ok(())
}

let auth = match &proto.auth { Some(a) => a, None => return Err(...) };

When it happens

Trigger: Calling from_protobuf on a secret proto whose auth field is None — e.g. a CREATE SECRET with HashiCorp Vault backend but no approle_auth (or other auth) clause specified.

Common situations: User creates a Vault-backed secret but omits the authentication clause; a migration or tooling script strips the auth field from the protobuf; older client versions that did not populate the auth message.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Field '{}' not found in secret
• Vault app role login failed: {} - {}
• Both `access_key` and `secret_key` must be provided
• NATS connect mode `user_and_password` requires both `user` a
• NATS connect mode `credential` requires both `nkey` and `jwt

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/1f07f3b28ab354eb. Report an issue: GitHub.