risingwavelabs/risingwave · critical

OSS_ACCESS_KEY_ID not found from environment variables

Error message

OSS_ACCESS_KEY_ID not found from environment variables

What it means

new_oss_engine panics when OSS_ACCESS_KEY_ID is absent from the environment. The OSS builder needs the access key id for credentials, read after OSS_ENDPOINT. The panic aborts startup instead of surfacing a recoverable ObjectError.

Source

Thrown at src/object_store/src/object/opendal_engine/oss.rs:40

use super::{MediaType, OpendalObjectStore, new_operator};
use crate::object::ObjectResult;
use crate::object::object_metrics::ObjectStoreMetrics;

impl OpendalObjectStore {
    /// create opendal oss engine.
    pub fn new_oss_engine(
        bucket: String,
        root: String,
        config: Arc<ObjectStoreConfig>,
        metrics: Arc<ObjectStoreMetrics>,
    ) -> ObjectResult<Self> {
        // Create oss backend builder.
        let mut builder = Oss::default().bucket(&bucket).root(&root);

        let endpoint = std::env::var("OSS_ENDPOINT")
            .unwrap_or_else(|_| panic!("OSS_ENDPOINT not found from environment variables"));
        let access_key_id = std::env::var("OSS_ACCESS_KEY_ID")
            .unwrap_or_else(|_| panic!("OSS_ACCESS_KEY_ID not found from environment variables"));
        let access_key_secret = std::env::var("OSS_ACCESS_KEY_SECRET").unwrap_or_else(|_| {
            panic!("OSS_ACCESS_KEY_SECRET not found from environment variables")
        });

        builder = builder
            .endpoint(&endpoint)
            .access_key_id(&access_key_id)
            .access_key_secret(&access_key_secret);

        let op = new_operator(
            &config,
            Operator::new(builder)?.layer(LoggingLayer::default()),
        );

        Ok(Self {
            op,
            media_type: MediaType::Oss,
            config,

View on GitHub (pinned to 6469eb736d)

Solutions

1. Export OSS_ACCESS_KEY_ID with the Aliyun access key id before starting the process.
2. Verify all three OSS variables (OSS_ENDPOINT, OSS_ACCESS_KEY_ID, OSS_ACCESS_KEY_SECRET) are present: env | grep OSS_.
3. Fix the secret manifest/unit file so the variable is injected with the exact name OSS_ACCESS_KEY_ID.

Example fix

// before
let access_key_id = std::env::var("OSS_ACCESS_KEY_ID")
    .unwrap_or_else(|_| panic!("OSS_ACCESS_KEY_ID not found from environment variables"));
// after (shell)
export OSS_ACCESS_KEY_ID=LTAI5t...  # Aliyun access key id

for v in ["OSS_ENDPOINT", "OSS_ACCESS_KEY_ID", "OSS_ACCESS_KEY_SECRET"] {
    assert!(!std::env::var(v).unwrap_or_default().is_empty(), "{v} must be set");
}

When it happens

Trigger: Calling new_oss_engine with OSS_ENDPOINT set but OSS_ACCESS_KEY_ID unset in the process environment.

Common situations: Partial credential setup: operator exports OSS_ENDPOINT and OSS_ACCESS_KEY_SECRET but forgets the key id; secrets mounted under a different variable name in k8s/docker.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• OSS_ACCESS_KEY_SECRET not found from environment variables
• OSS_ENDPOINT not found from environment variables
• failed to parse static creds
• Passing s3-compatible is not supported, please modify the en
• {} remote object store only supports s3, minio, gcs, oss, co

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/e36c441a3e5208ed. Report an issue: GitHub.