risingwavelabs/risingwave · error · SecretError

secret not found: {0}

Error message

secret not found: {0}

What it means

SecretError::ItemNotFound is raised when a secret is looked up by SecretId but no secret with that id exists in the secret manager / storage backend. Callers such as the secret handling code in meta/frontend convert this into an error surfaced to the SQL client when a referenced secret cannot be resolved.

Source

Thrown at src/common/secret/src/error.rs:25

//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

pub use anyhow::anyhow;
use thiserror::Error;
use thiserror_ext::Construct;

use super::SecretId;

pub type SecretResult<T> = Result<T, SecretError>;

#[derive(Error, Debug, Construct)]
pub enum SecretError {
    #[error("secret not found: {0}")]
    ItemNotFound(SecretId),

    #[error("decode utf8 error: {0}")]
    DecodeUtf8Error(#[from] std::string::FromUtf8Error),

    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

    #[error("unspecified secret ref type: {0}")]
    UnspecifiedRefType(SecretId),

    #[error("failed to encrypt or decrypt the secret")]
    AesError,

    #[error("ser/de proto message error: {0}")]
    ProtoError(#[from] bincode::Error),

    #[error(transparent)]

View on GitHub (pinned to 6469eb736d)

Solutions

1. Create the secret first with `CREATE SECRET <name> WITH (...)` before referencing it.
2. Verify the exact secret id/name (list existing secrets) and correct typos or case.
3. Re-create the secret if it was dropped, then retry the operation.
4. Check you are connected to the same cluster/database where the secret exists.

Example fix

-- before
SELECT * FROM my_source; -- references secret 'my_kafka_secret' that does not exist

-- after
CREATE SECRET my_kafka_secret WITH (type='kafka', ...);
SELECT * FROM my_source;

// Before resolving a secret, check it exists:
async fn secret_exists(manager: &SecretManagerRef, id: &SecretId) -> bool {
    manager.list().await.map(|secrets| secrets.contains_key(id)).unwrap_or(false)
}

fn validate_secret_lookup(result: &Result<Secret, SecretError>) -> Option<&Secret> {
    match result {
        Ok(s) => Some(s),
        Err(SecretError::ItemNotFound(id)) => {
            tracing::warn!("secret {} not found; was CREATE SECRET run?", id);
            None
        }
        _ => None,
    }
}

match manager.get(secret_id).await {
    Ok(secret) => use_secret(secret),
    Err(SecretError::ItemNotFound(id)) => {
        // prompt user to CREATE SECRET or fall back to explicit credentials
        return Err(anyhow!("secret {id} missing; run CREATE SECRET first"));
    }
    Err(e) => return Err(e.into()),
}

When it happens

Trigger: Calling the secret manager's get/fetch API with a SecretId that was never created, or whose underlying secret was dropped; resolving a `SECRET <name>` reference whose backing entry is missing at read time.

Common situations: A CREATE SECRET was never run (or ran against a different cluster/database); the secret was dropped by another session between creation of a dependent object and its use; typos or case sensitivity in the secret id/name; restoring into an environment where secrets were not carried over.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• decode utf8 error: {0}
• I/O error: {0}
• unspecified secret ref type: {0}
• failed to encrypt or decrypt the secret
• ser/de proto message error: {0}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/465d82ff2f727ea4. Report an issue: GitHub.