vitessio/vitess · error

cannot load credentials from path template %s: %w

Error message

cannot load credentials from path template %s: %w

What it means

vtctldclient config Parse loads gRPC credentials from a Go text/template path (`credentials-path-tmpl`) via credentials.LoadFromTemplate. If reading/rendering the template or the resulting credentials file fails, Parse returns this wrapped error including the template string. It is a startup-time configuration error, not a runtime dial error.

Source

Thrown at go/vt/vtadmin/vtctldclient/config.go:106

	if c.ResolverOptions == nil {
		c.ResolverOptions = &resolver.Options{}
	}

	c.ResolverOptions.InstallFlags(fs)

	credentialsTmplStr := fs.String("credentials-path-tmpl", "",
		"Go template used to specify a path to a credentials file, which is a json file containing "+
			"a Username and Password. Templates are given the context of the vtctldclient.Config, "+
			"and primarily interoplate the cluster name and ID variables.")

	if err := fs.Parse(args); err != nil {
		return err
	}

	if *credentialsTmplStr != "" {
		creds, path, err := credentials.LoadFromTemplate(*credentialsTmplStr, c)
		if err != nil {
			return fmt.Errorf("cannot load credentials from path template %s: %w", *credentialsTmplStr, err)
		}

		c.CredentialsPath = path
		c.Credentials = creds
	}

	return nil
}

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Verify the file the rendered template points to exists and is readable (test by printing the rendered path with the same config values).
2. Check the credentials file contents are valid (expected user/password JSON consumed by grpcclient static auth).
3. Simplify the template: replace template placeholders with a literal path to isolate whether the template or the file is the problem.
4. Alternatively pass a static credentials-path instead of credentials-path-tmpl.

Example fix

// before
--credentials-path-tmpl "$HOME/.vitessedata/{{.Cluster}}/creds"
// after (verify file exists; hardcode path if cluster field is unset)
--credentials-path "$HOME/.vitessedata/prod/creds"

// Shell: verify the rendered credentials file exists and parses before launch
CREDS_PATH=$(render_template "$CREDS_TMPL")
test -r "$CREDS_PATH" && jq -e . "$CREDS_PATH" >/dev/null || { echo "credentials file missing/invalid: $CREDS_PATH"; exit 1; }

cfg, err := config.Parse(fs, flags, args); if err != nil && strings.Contains(err.Error(), "cannot load credentials") { /* inspect template + file */ }

When it happens

Trigger: Calling vtctldclient/config.Parse with a non-empty credentials-path-tmpl flag when the template references unset config fields or points to a missing/unreadable/invalid credentials file.

Common situations: Wrong path template syntax (e.g. {{.Keyspace}} on a config without that field); credentials file moved or mounted late in a container; file permissions deny read; malformed JSON in the credentials file.

Related errors

• cannot load credentials from path template %s: %w
• unregistered Authenticator implementation
• %w: no cluster with id %s
• error creating vtctldclient proxy config: %w
• failed to execute tablet FQDN template for %+v: %w

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/54b5cc89a70d5653. Report an issue: GitHub.