Install secret error codes (mpbx-installer)
Raised by mpbx init and by the secret preflight of mpbx run (ARCHITECTURE section 15). No
message ever contains a secret value; messages name the variable only. Guide:
install secrets.
| Code | Kind | Meaning | What to do |
|---|---|---|---|
MPBX-SECRETS-MISSING | config | mpbx run found a required secret unset or empty (the message lists every one), or the secrets file named by --secrets-file / MPBX_SECRETS_FILE does not exist. mpbx run exits with code 78. | Run mpbx init and pass the secrets to the process (environment, env_file, envFrom, or --secrets-file). |
MPBX-SECRETS-WEAK | config | A secret is shorter than the minimum (24 characters for passwords), low-entropy, a known test or default value (changeme, password, ...), a published RFC 8032 test key, or the same value as another secret. Raised by mpbx run (exit 78) and by mpbx init when an existing sink already holds such a value. | Replace the value with a random one. mpbx init never replaces an existing value by itself, because that could lock you out of data encrypted with it. |
MPBX-SECRETS-INVALID | config | A secret is malformed (for example a key that is not base64url of 32 bytes) or inconsistent (a public key that does not match its private key, a MPBX_MASTER_KEY_ID that does not match the master key). | Restore the original value from a backup. |
MPBX-SECRETS-PARTIAL | config | Some members of a group are present and others are missing (for example MPBX_JWT_PUBLIC_KEY without MPBX_JWT_SIGNING_KEY), or an existing Kubernetes Secret lacks keys. mpbx init refuses to "repair" it. | Restore the missing values from a backup. Delete the group or Secret only on a new install with no data. |
MPBX-SECRETS-CONFLICT | conflict | mpbx init --rotate master-key found a sink holding an unexpected master key value or lost a Kubernetes 409 race (nothing is replaced in that sink). Two sinks hold different values for the same secret, a sink was created by someone else while mpbx init ran (Kubernetes 409 Conflict, or a file that appeared), or --recovery-key-file already exists. | For a race, run mpbx init again (it then finds the secrets and does nothing). For different values, decide which sink is right and fix the other by hand. |
MPBX-SECRETS-SINK | unavailable / invalid_argument | A sink cannot be read or written: bad --sink syntax, I/O error, Kubernetes API unreachable, HTTP 401/403 (the message names the RBAC needed), bad base64 in a Secret. | Fix the path, permissions or RBAC (get and create on secrets). |
MPBX-SECRETS-INSECURE-FILE | config | The file: sink exists with group or other permissions. | chmod 600 <file> (and check who could have read it). |
MPBX-SECRETS-RNG | internal | The OS random number generator failed. mpbx init never falls back to a weaker source. | Check the host (entropy source, seccomp profile) and retry. |
MPBX-RECOVERY-NOT-CONFIRMED | invalid_argument | Interactive mpbx init: the requested group of the recovery key was not typed correctly three times. Nothing was written. | Run mpbx init again; a new master key and recovery key are generated. |
MPBX-RECOVERY-KEY-INVALID | invalid_argument | A typed recovery key has a wrong length, a character outside the alphabet, or a checksum mismatch (typo). | Re-type it. I/L are read as 1 and O as 0; dashes, spaces and case do not matter. |
MPBX-USAGE | invalid_argument | Unknown or malformed mpbx init / mpbx run argument. Exit code 2. | See mpbx init --help. |