xai-org/x-algorithm · error · anyhow::Error

{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set

Error message

{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set

What it means

Raised in from_env when mTLS is enabled (the earlier check returned Ok(None) only when disabled) but the GRPC_MTLS_SERVER_KEY_PATH environment variable is unset or empty. Server mTLS config cannot be constructed without the server private key path.

Source

Thrown at visibility-filtering/config.rs:101

pub struct GrpcMtlsConfig {
    pub server_key_path: String,
    pub server_crt_path: String,
    pub server_chain_path: Option<String>,
    pub client_ca_path: String,
}

impl GrpcMtlsConfig {
    pub fn from_env() -> anyhow::Result<Option<Self>> {
        let enabled = parse_env_flag(std::env::var(ENV_GRPC_MTLS_ENABLED).ok().as_deref());

        if !enabled {
            return Ok(None);
        }

        let server_key_path = std::env::var(ENV_GRPC_MTLS_SERVER_KEY_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set"))?;

        let server_crt_path = std::env::var(ENV_GRPC_MTLS_SERVER_CRT_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set"))?;

        let server_chain_path = std::env::var(ENV_GRPC_MTLS_SERVER_CHAIN_PATH)
            .ok()
            .filter(|v| !v.is_empty());

        let client_ca_path = std::env::var(ENV_GRPC_MTLS_CLIENT_CA_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set"))?;

        Ok(Some(Self {
            server_key_path,
            server_crt_path,

View on GitHub (pinned to 24c60942c5)

Solutions

1. Set GRPC_MTLS_SERVER_KEY_PATH to the path of the server TLS key file (non-empty)
2. Verify the var is actually injected into the container/pod environment (kubectl exec env | grep GRPC_MTLS)
3. If mTLS is not intended in this environment, disable the mTLS flag so from_env returns None
4. Use a startup preflight that checks all four mTLS env vars together and reports all missing ones

Example fix

# before
# mTLS enabled, key path missing

# after
export GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key
export GRPC_MTLS_SERVER_CRT_PATH=/etc/certs/server.crt
export GRPC_MTLS_CLIENT_CA_PATH=/etc/certs/client_ca.crt
# optionally: export GRPC_MTLS_SERVER_CHAIN_PATH=/etc/certs/chain.crt

fn require_env(name: &str) -> Result<String> { std::env::var(name).ok().filter(|v| !v.is_empty()).ok_or_else(|| anyhow::anyhow!("{name} must be set")) }

null

When it happens

Trigger: Enabling gRPC mTLS in the visibility-filtering service while GRPC_MTLS_SERVER_KEY_PATH is missing from the environment or set to an empty string.

Common situations: Deploying with mTLS enabled but the secret/env not mounted; helm/k8s env var name typos; local runs copying config without cert envs; CI missing cert envs.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• {ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set
• {ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set
• {ENV_CACHE_WARM_SAMPLE_PCT}: {error}
• {misconfiguration}
• MM_LOCAL_SNAPSHOT: failed to read {path}: {e}

AI-assisted analysis of xai-org/x-algorithm@24c60942c5 (2026-08-28). Data as JSON: /api/errors/ad7855ca8480c1ae. Report an issue: GitHub.