risingwavelabs/risingwave · error

No available private link endpoints for Kafka broker {}

Error message

No available private link endpoints for Kafka broker {}

What it means

When rewriting each broker address through the PrivateLink DNS entries, the resolved service exists but has an empty `dns_entries` list — no usable endpoint name is available — so the rewrite for that broker fails with this error.

Source

Thrown at src/connector/src/source/kafka/private_link.rs:162

        // if it is a string, rewrite all broker addresses to the same endpoint
        // eg. privatelink.endpoint='some_url' ==> broker1:9092 -> some_url:9092, broker2:9093 -> some_url:9093
        // if it is a json array, rewrite each broker address to the corresponding endpoint
        // eg. privatelink.endpoint = '[{"host": "aaaa"}, {"host": "bbbb"}, {"host": "cccc"}]'
        // ==> broker1:9092 -> aaaa:9092, broker2:9093 -> bbbb:9093, broker3:9094 -> cccc:9094
        handle_privatelink_endpoint(
            &endpoint,
            &mut broker_rewrite_map,
            &link_targets,
            &broker_addrs,
        )?;
    } else {
        if svc.is_none() {
            bail!("PrivateLink endpoint not found");
        }
        let svc = svc.unwrap();
        for (link, broker) in link_targets.iter().zip_eq_fast(broker_addrs.into_iter()) {
            if svc.dns_entries.is_empty() {
                bail!(
                    "No available private link endpoints for Kafka broker {}",
                    broker
                );
            }
            // rewrite the broker address to the dns name w/o az
            // requires the NLB has enabled the cross-zone load balancing
            broker_rewrite_map.insert(
                broker.to_owned(),
                format!("{}:{}", svc.endpoint_dns_name, link.port),
            );
        }
    }

    // save private link dns names into source properties, which
    // will be extracted into KafkaProperties
    let json = serde_json::to_string(&broker_rewrite_map).map_err(|e| anyhow!(e))?;
    with_options.insert(PRIVATE_LINK_BROKER_REWRITE_MAP_KEY.to_owned(), json);
    Ok(())

View on GitHub (pinned to 6469eb736d)

Solutions

1. Wait until the VPC endpoint is fully available and verify it has DNS names (`aws ec2 describe-vpc-endpoints`)
2. Use the correct endpoint whose service exposes DNS entries; enable private DNS / use the endpoint's DNS name
3. Re-run source creation after endpoint provisioning completes
4. Verify the endpoints JSON references the intended vpce IDs

let eps = aws ec2 describe-vpc-endpoints --vpc-endpoint-ids ... ;
if eps.empty_or_no_dns { return Err("endpoint has no DNS entries yet"); }

When it happens

Trigger: In the multi-VPC PrivateLink branch, iterating `(link_target, broker)` pairs, `svc.dns_entries.is_empty()` is true for any broker: the VPC endpoint exists but exposes no DNS names (e.g. endpoint not fully provisioned or wrong endpoint supplied).

Common situations: VPC endpoint created but still provisioning; user passed an interface endpoint without DNS enabled; querying the wrong endpoint's service info; AWS API returned partial metadata transiently.

Understand the failure class

Background: "empty response", "returned no data", "empty embeddings": what HTTP 200-with-empty-body errors mean across libraries — this error's family across 36 libraries.

Related errors

• PrivateLink endpoint not found
• The number of broker addrs {} does not match the number of p
• expected JSON in the form {{"host": "endpoint url"}}, but go
• missing aws credentials_provider
• missing aws region

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/f0f05850e997f17d. Report an issue: GitHub.