risingwavelabs/risingwave · critical

OSS_ACCESS_KEY_SECRET not found from environment variables

Error message

OSS_ACCESS_KEY_SECRET not found from environment variables

What it means

new_oss_engine panics when OSS_ACCESS_KEY_SECRET is missing. This is the third required OSS credential variable; the OSS builder calls access_key_secret with it. Like the sibling checks, it panics rather than returning an error.

Source

Thrown at src/object_store/src/object/opendal_engine/oss.rs:42

use crate::object::object_metrics::ObjectStoreMetrics;

impl OpendalObjectStore {
    /// create opendal oss engine.
    pub fn new_oss_engine(
        bucket: String,
        root: String,
        config: Arc<ObjectStoreConfig>,
        metrics: Arc<ObjectStoreMetrics>,
    ) -> ObjectResult<Self> {
        // Create oss backend builder.
        let mut builder = Oss::default().bucket(&bucket).root(&root);

        let endpoint = std::env::var("OSS_ENDPOINT")
            .unwrap_or_else(|_| panic!("OSS_ENDPOINT not found from environment variables"));
        let access_key_id = std::env::var("OSS_ACCESS_KEY_ID")
            .unwrap_or_else(|_| panic!("OSS_ACCESS_KEY_ID not found from environment variables"));
        let access_key_secret = std::env::var("OSS_ACCESS_KEY_SECRET").unwrap_or_else(|_| {
            panic!("OSS_ACCESS_KEY_SECRET not found from environment variables")
        });

        builder = builder
            .endpoint(&endpoint)
            .access_key_id(&access_key_id)
            .access_key_secret(&access_key_secret);

        let op = new_operator(
            &config,
            Operator::new(builder)?.layer(LoggingLayer::default()),
        );

        Ok(Self {
            op,
            media_type: MediaType::Oss,
            config,
            metrics,
        })

View on GitHub (pinned to 6469eb736d)

Solutions

1. Export OSS_ACCESS_KEY_SECRET with the Aliyun access key secret before startup.
2. Confirm all three OSS_* variables are set and non-empty (env | grep OSS_); note empty-string values still fail authentication later.
3. If using a secret injection system, ensure the env name matches OSS_ACCESS_KEY_SECRET exactly (case-sensitive).

Example fix

// before
let access_key_secret = std::env::var("OSS_ACCESS_KEY_SECRET")
    .unwrap_or_else(|_| panic!("OSS_ACCESS_KEY_SECRET not found from environment variables"));
// after (shell)
export OSS_ACCESS_KEY_SECRET='xxxxxxxxxxxxxxxx'

if std::env::var("OSS_ACCESS_KEY_SECRET").map(|v| v.is_empty()).unwrap_or(true) {
    return Err(anyhow!("OSS_ACCESS_KEY_SECRET must be set"));
}

When it happens

Trigger: Calling new_oss_engine with OSS_ENDPOINT and OSS_ACCESS_KEY_ID set but OSS_ACCESS_KEY_SECRET unset.

Common situations: Secrets manager writes only the key id; secret value contains leading/trailing whitespace or quotes causing a lookup mismatch; docker -e flag quoting dropped the variable.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• OSS_ACCESS_KEY_ID not found from environment variables
• OSS_ENDPOINT not found from environment variables
• failed to parse static creds
• Passing s3-compatible is not supported, please modify the en
• {} remote object store only supports s3, minio, gcs, oss, co

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/4baa61101e3cf650. Report an issue: GitHub.