risingwavelabs/risingwave · critical

OBS_ACCESS_KEY_ID not found from environment variables

Error message

OBS_ACCESS_KEY_ID not found from environment variables

What it means

new_obs_engine reads the OBS access key id from OBS_ACCESS_KEY_ID and panics if unset, because OBS authentication cannot proceed without credentials. The panic occurs at object store build time after OBS_ENDPOINT is successfully read.

Source

Thrown at src/object_store/src/object/opendal_engine/obs.rs:40

use super::{MediaType, OpendalObjectStore, new_operator};
use crate::object::ObjectResult;
use crate::object::object_metrics::ObjectStoreMetrics;

impl OpendalObjectStore {
    /// create opendal obs engine.
    pub fn new_obs_engine(
        bucket: String,
        root: String,
        config: Arc<ObjectStoreConfig>,
        metrics: Arc<ObjectStoreMetrics>,
    ) -> ObjectResult<Self> {
        // Create obs backend builder.
        let mut builder = Obs::default().bucket(&bucket).root(&root);

        let endpoint = std::env::var("OBS_ENDPOINT")
            .unwrap_or_else(|_| panic!("OBS_ENDPOINT not found from environment variables"));
        let access_key_id = std::env::var("OBS_ACCESS_KEY_ID")
            .unwrap_or_else(|_| panic!("OBS_ACCESS_KEY_ID not found from environment variables"));
        let secret_access_key = std::env::var("OBS_SECRET_ACCESS_KEY").unwrap_or_else(|_| {
            panic!("OBS_SECRET_ACCESS_KEY not found from environment variables")
        });

        builder = builder
            .endpoint(&endpoint)
            .access_key_id(&access_key_id)
            .secret_access_key(&secret_access_key);

        let op = new_operator(
            &config,
            Operator::new(builder)?.layer(LoggingLayer::default()),
        );

        Ok(Self {
            op,
            media_type: MediaType::Obs,
            config,

View on GitHub (pinned to 6469eb736d)

Solutions

1. Export OBS_ACCESS_KEY_ID with a valid Huawei Cloud access key before starting RisingWave
2. Mount the credential via your secret manager and expose it as OBS_ACCESS_KEY_ID
3. Double-check spelling/case of the variable name in your deployment config
4. Also ensure OBS_SECRET_ACCESS_KEY is set to avoid the next panic

Example fix

# before
env OBS_ENDPOINT=... ./risingwave  # OBS_ACCESS_KEY_ID missing -> panic
# after
env OBS_ENDPOINT=... OBS_ACCESS_KEY_ID=<key> OBS_SECRET_ACCESS_KEY=<secret> ./risingwave

if std::env::var("OBS_ACCESS_KEY_ID").is_err() {
    eprintln!("OBS_ACCESS_KEY_ID must be set for obs:// object store");
    std::process::exit(1);
}

When it happens

Trigger: Using an obs:// remote store with OBS_ENDPOINT set but OBS_ACCESS_KEY_ID missing from the process environment.

Common situations: Partially configured deployments where the endpoint was added but credentials were not, secret not mounted in Kubernetes, or credential variable renamed.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• OBS_SECRET_ACCESS_KEY not found from environment variables
• OBS_ENDPOINT not found from environment variables
• AZBLOB_ENDPOINT not found from environment variables
• failed to parse static creds
• gcs.service.account is required with Google Cloud Storage (G

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/339b8173bc9c11b6. Report an issue: GitHub.