What causes "Failed to get RRSA credentials" in apache/iceberg?

Inspect the cause chain (e.getCause()) for the actual STS error — fix the specific RRSA property (oidc-provider-arn, role-arn, session-name) it reports.

apache/iceberg · error · RuntimeException

Failed to get RRSA credentials

Error message

Failed to get RRSA credentials

What it means

When RRSA (RAM Roles for Service Accounts) authentication is configured, the OSS credential provider fetches temporary STS credentials via the Alibaba Cloud SDK. Any exception during that credential fetch is wrapped in this RuntimeException("Failed to get RRSA credentials", e). The root cause chain holds the underlying SDK error.

Source

Thrown at aliyun/src/main/java/org/apache/iceberg/aliyun/AliyunClientFactories.java:159

                public Credentials getCredentials() {
                  try {
                    LOG.debug("Getting credentials using RRSA");
                    // getCredentials() returns cached credentials and auto-refreshes when needed
                    CredentialModel cred = oidcProvider.getCredentials();
                    long expirationSeconds = 0;
                    if (cred.getExpiration() > 0) {
                      expirationSeconds =
                          (cred.getExpiration() - System.currentTimeMillis()) / 1000;
                    }
                    this.currentCredentials =
                        new BasicCredentials(
                            cred.getAccessKeyId(),
                            cred.getAccessKeySecret(),
                            cred.getSecurityToken(),
                            expirationSeconds);
                    return this.currentCredentials;
                  } catch (Exception e) {
                    throw new RuntimeException("Failed to get RRSA credentials", e);
                  }
                }
              };
          return new OSSClientBuilder().build(endpoint, ossCredProvider);
        } catch (Exception e) {
          throw new RuntimeException("Failed to create RRSA OSS client", e);
        }
      } else if (Strings.isNullOrEmpty(aliyunProperties.securityToken())) {
        return new OSSClientBuilder()
            .build(
                aliyunProperties.ossEndpoint(),
                aliyunProperties.accessKeyId(),
                aliyunProperties.accessKeySecret());
      } else {
        return new OSSClientBuilder()
            .build(
                aliyunProperties.ossEndpoint(),
                aliyunProperties.accessKeyId(),

View on GitHub (pinned to 86d9c8fc54)

Solutions

Inspect the cause chain (e.getCause()) for the actual STS error — fix the specific RRSA property (oidc-provider-arn, role-arn, session-name) it reports.
Verify the Kubernetes service account is annotated with the correct role ARN and the pod uses that service account.
Check cluster network egress to the STS/OIDC endpoints.
Re-check the RRSA setup in ACK (role trust policy must allow the OIDC provider and sa namespace/sa name).

Example fix

// before (incomplete props)
conf.set("io.manifest.cache-credential-oidc-provider-arn", "");

// after
conf.set("...oidc-provider-arn", "acs:ram::123:oidc-provider/ack-rrsa");
conf.set("...role-arn", "acs:ram::123:role/iceberg-rrsa");
conf.set("...session-name", "iceberg");

Defensive patterns

Strategy: try-catch

Validate before calling

// Before starting the job, verify RRSA props are present:
assert !oidcProviderArn.isEmpty() && !roleArn.isEmpty() && !sessionName.isEmpty();
// And that the pod has a projected OIDC service account token:
Files.exists(Path.of("/var/run/secrets/eks...or ACK oidc token path"));

Try / catch

try {
  Table table = catalog.loadTable(identifier);
} catch (RuntimeException e) {
  if (e.getMessage() != null && e.getMessage().contains("Failed to get RRSA credentials")) {
    // inspect e.getCause(), refresh RRSA config, then retry with backoff
  }
}

Prevention

Validate RRSA properties (OIDC provider ARN, role ARN, session name) at job startup.
Ensure the K8s service account annotations and role trust policy match namespace/SA name.
Add retry with backoff around client creation for transient STS errors.
Monitor cluster egress to STS endpoints.

When it happens

Trigger: Calling newOSSClient (via AliyunClientFactories.client) with RRSA enabled: missing/mis-set OIDC provider ARN, role ARN, or session name properties; network failure calling Alibaba STS; the pod not actually running under the annotated service account so AssumeRoleWithOIDC is rejected.

Common situations: K8s pods using ACK RRSA where the service account annotations are wrong or removed; expired/rotated OIDC provider; STS endpoint unreachable from the cluster network; clock skew invalidating token.

Related errors

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/c718a429b9ab1632. Report an issue: GitHub.