CLI errors
Available
Deployed and supported. The fields and commands described here are stable within version v1alpha1.
sng writes its errors to standard error and exits with code 1. Two families:
local errors (configuration, files) and errors returned by the API, displayed with
their message, sometimes supplemented by an instruction. Add -v to see the method and the URL
called, in parentheses.
Sign-in and session
| Message | Cause | Fix |
|---|---|---|
not authenticated: run sng sso login | No identity, or identity expired | sng sso login |
session expired: run sng tenant use NAME (or sng sso login if identity is expired) | Token expired or revoked | sng sso login, then sng tenant use <tenant> |
tenant session required: run sng tenant use NAME | Tenant command without a current tenant | sng tenant use <tenant> |
identity token required: run sng sso login | Identity command run with only a session (CI that provided STNG_TENANT_TOKEN) | Provide an identity (sng sso login) |
waiting for the tenant default policies… | Newly created tenant: its policies are not active yet | Nothing: the CLI waits up to six minutes |
tenant policies not applied yet; retry `sng tenant use NAME` in a minute | Same, wait exceeded | Retry in a minute |
no assume-role on tenant "NAME": ask an admin to run `sng tenant policy attach assume-role …` | No policy of the tenant lets you open a session in it | Ask an administrator to run the command shown |
Local configuration
| Message | Cause | Fix |
|---|---|---|
unknown cluster "…" (available: …) | The cluster does not exist | sng config use-cluster NAME with a name from the list |
tenant session required: run sng tenant use NAME | No current tenant | sng tenant use NAME |
parse config … | Corrupted configuration file | Delete ~/.config/stackngo/config.yaml, then sng config create and sng sso login |
TLS error or https required | api_url or STNG_API_URL in http:// to a remote host | Use https:// |
Manifests
| Message | Cause | Fix |
|---|---|---|
validation failed (N issue(s)) | sng validate found errors, listed above | Fix each error: line |
invalid manifest … | Schema or cross-field rule violated; the message names the field | See the kind's reference page |
unsupported kind … | Kind that sng apply does not accept (typo, kind reserved for the platform) | Check the list of kinds |
Rejection that mentions metadata | The manifest specifies a location or a tenant in metadata | Remove it: the tenant comes from your session |
metadata : seul name est permis (… refusé) | Label, annotation, tenant or any key other than name in metadata | Remove it |
conflict | Name or host already taken, or resource being deleted | Rename, or wait |
kind/name must not change … | sng kind edit: kind or metadata.name modified | Create the new resource, delete the old one |
edit expects exactly 1 YAML document, found N | sng kind edit: several documents in the file | A single document |
Deletions
| Message | Cause | Fix |
|---|---|---|
confirmation requise : relancez avec --yes … | Deletion run outside a terminal (script, CI) | Add -y |
opération annulée | Confirmation declined | — |
Permissions
| Message | Cause | Fix |
|---|---|---|
forbidden (no policy of this tenant allows it: see sng tenant policy list) | The session does not have the required IAM action | See the action catalog and ask an administrator for the policy |
authorization service unavailable: retry later | The authorization service does not respond; no access is granted | Retry |
CI (OIDC)
| Message | Cause | Fix |
|---|---|---|
no CI OIDC token: set STNG_OIDC_TOKEN … | No OIDC token exposed to the job | id_tokens (GitLab) or permissions: id-token: write (GitHub) |
OIDC: tenant required: set STNG_TENANT … | STNG_TENANT missing | Define it |
invalid identity token | No trust matches the token, or several do | Compare iss, aud, sub with sng tenant oidc get; set STNG_OIDC_TRUST |
jeton OIDC du CI expiré … | The token provided by variable expired during the job | Rerun the job |
Report a problem
Include the command, the output with -v, the time (UTC) and the tenant. Never include
your configuration file: it contains your tokens.