risingwavelabs/risingwave · error

PrivateLink endpoint not found

Error message

PrivateLink endpoint not found

What it means

For MSK multi-VPC private link connections, RisingWave looks up the attached PrivateLink service/endpoint information. When the target is multi-VPC ('msk' type path) but no matching service endpoint entry was found, this bail fires because there is nothing to resolve broker DNS names against.

Source

Thrown at src/connector/src/source/kafka/private_link.rs:157

        );
    }

    if let Some(endpoint) = privatelink_endpoint {
        // new syntax: endpoint can either be a string or a json array of strings
        // if it is a string, rewrite all broker addresses to the same endpoint
        // eg. privatelink.endpoint='some_url' ==> broker1:9092 -> some_url:9092, broker2:9093 -> some_url:9093
        // if it is a json array, rewrite each broker address to the corresponding endpoint
        // eg. privatelink.endpoint = '[{"host": "aaaa"}, {"host": "bbbb"}, {"host": "cccc"}]'
        // ==> broker1:9092 -> aaaa:9092, broker2:9093 -> bbbb:9093, broker3:9094 -> cccc:9094
        handle_privatelink_endpoint(
            &endpoint,
            &mut broker_rewrite_map,
            &link_targets,
            &broker_addrs,
        )?;
    } else {
        if svc.is_none() {
            bail!("PrivateLink endpoint not found");
        }
        let svc = svc.unwrap();
        for (link, broker) in link_targets.iter().zip_eq_fast(broker_addrs.into_iter()) {
            if svc.dns_entries.is_empty() {
                bail!(
                    "No available private link endpoints for Kafka broker {}",
                    broker
                );
            }
            // rewrite the broker address to the dns name w/o az
            // requires the NLB has enabled the cross-zone load balancing
            broker_rewrite_map.insert(
                broker.to_owned(),
                format!("{}:{}", svc.endpoint_dns_name, link.port),
            );
        }
    }

View on GitHub (pinned to 6469eb736d)

Solutions

1. Provide `privatelink.endpoints` JSON in WITH options, e.g. '{"broker-1.host":"vpce-xxx..."}' mapping each broker host to its VPC endpoint
2. Verify the JSON keys exactly match the broker addresses from bootstrap servers
3. Check the WITH option spelling (`privatelink.endpoints`) and that it wasn't removed before this code runs
4. For MSK multi-VPC, use the broker/az association from `aws msk describe-cluster` to build the mapping

Example fix

// before
WITH (connector='kafka', privatelink.targets='[...]' /* no endpoints */)
// after
WITH (
  connector='kafka',
  privatelink.targets='[...] ',
  privatelink.endpoints='{"b-1.msk.us-east-1.amazonaws.com:9096":"vpce-0abc123"}'
)

if using_multi_vpc && with_options.get("privatelink.endpoints").is_none() {
    return Err("privatelink.endpoints is required for MSK multi-VPC private link");
}

When it happens

Trigger: `insert_privatelink_broker_rewrite_map` reaches the multi-VPC branch where `svc` (the looked-up PrivateLink service endpoint, derived from the provided endpoint JSON) is None — the user supplied no `privatelink.endpoints` entry or it didn't match the expected key.

Common situations: User configured msk multi-VPC private link targets but forgot the `privatelink.endpoints` WITH option; endpoint JSON keyed by wrong broker host; typo in option name so the endpoints value never reaches the handler.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing aws region
• The number of broker addrs {} does not match the number of p
• No available private link endpoints for Kafka broker {}
• expected JSON in the form {{"host": "endpoint url"}}, but go
• missing aws credentials_provider

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/a228f2b07b8deb52. Report an issue: GitHub.