risingwavelabs/risingwave · critical

OBS_SECRET_ACCESS_KEY not found from environment variables

Error message

OBS_SECRET_ACCESS_KEY not found from environment variables

What it means

new_obs_engine reads the OBS secret access key from OBS_SECRET_ACCESS_KEY and panics if unset, as OBS signing requires both the access key id and its secret. This is the last of the three required OBS env vars checked at store construction.

Source

Thrown at src/object_store/src/object/opendal_engine/obs.rs:42

use crate::object::object_metrics::ObjectStoreMetrics;

impl OpendalObjectStore {
    /// create opendal obs engine.
    pub fn new_obs_engine(
        bucket: String,
        root: String,
        config: Arc<ObjectStoreConfig>,
        metrics: Arc<ObjectStoreMetrics>,
    ) -> ObjectResult<Self> {
        // Create obs backend builder.
        let mut builder = Obs::default().bucket(&bucket).root(&root);

        let endpoint = std::env::var("OBS_ENDPOINT")
            .unwrap_or_else(|_| panic!("OBS_ENDPOINT not found from environment variables"));
        let access_key_id = std::env::var("OBS_ACCESS_KEY_ID")
            .unwrap_or_else(|_| panic!("OBS_ACCESS_KEY_ID not found from environment variables"));
        let secret_access_key = std::env::var("OBS_SECRET_ACCESS_KEY").unwrap_or_else(|_| {
            panic!("OBS_SECRET_ACCESS_KEY not found from environment variables")
        });

        builder = builder
            .endpoint(&endpoint)
            .access_key_id(&access_key_id)
            .secret_access_key(&secret_access_key);

        let op = new_operator(
            &config,
            Operator::new(builder)?.layer(LoggingLayer::default()),
        );

        Ok(Self {
            op,
            media_type: MediaType::Obs,
            config,
            metrics,
        })

View on GitHub (pinned to 6469eb736d)

Solutions

1. Export OBS_SECRET_ACCESS_KEY with the secret matching OBS_ACCESS_KEY_ID before starting RisingWave
2. Verify the Kubernetes secret/docker env includes the secret key value
3. Confirm the key id and secret pair are valid and from the same Huawei Cloud credential set
4. Check env visibility inside the process: env | grep OBS_SECRET

Example fix

# before
env OBS_ENDPOINT=... OBS_ACCESS_KEY_ID=AK ./risingwave  # secret missing -> panic
# after
env OBS_ENDPOINT=... OBS_ACCESS_KEY_ID=AK OBS_SECRET_ACCESS_KEY=SK ./risingwave

if std::env::var("OBS_SECRET_ACCESS_KEY").is_err() {
    eprintln!("OBS_SECRET_ACCESS_KEY must be set for obs:// object store");
    std::process::exit(1);
}

When it happens

Trigger: Using an obs:// remote store with OBS_ENDPOINT and OBS_ACCESS_KEY_ID set but OBS_SECRET_ACCESS_KEY missing from the environment.

Common situations: Secrets partially synced into the deployment (e.g. only the key id mounted), typo in the secret variable name, or rotation removing the secret before restart.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• OBS_ACCESS_KEY_ID not found from environment variables
• OBS_ENDPOINT not found from environment variables
• AZBLOB_ENDPOINT not found from environment variables
• failed to parse static creds
• gcs.service.account is required with Google Cloud Storage (G

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/8c2b4679cdd6711b. Report an issue: GitHub.