apache/kafka · error · ConfigException

Could not read properties from file {path}

Error message

Could not read properties from file {path}

What it means

Thrown as a ConfigException by FileConfigProvider.get(String path) when an IOException occurs while opening or loading the Properties file at the given path. The underlying IOException is logged at ERROR level (with the path and exception) just before the ConfigException is raised, so the root cause (missing file, permissions, malformed encoding) is in the log but not in the exception message. It represents a terminal failure to externalize configuration values from a Properties file referenced via a config provider variable like ${file:/etc/kafka/secrets.properties:key}.

Source

Thrown at clients/src/main/java/org/apache/kafka/common/config/provider/FileConfigProvider.java:92

            log.warn("The path {} is not allowed to be accessed", path);
            return new ConfigData(data);
        }

        try (Reader reader = reader(filePath)) {
            Properties properties = new Properties();
            properties.load(reader);
            Enumeration<Object> keys = properties.keys();
            while (keys.hasMoreElements()) {
                String key = keys.nextElement().toString();
                String value = properties.getProperty(key);
                if (value != null) {
                    data.put(key, value);
                }
            }
            return new ConfigData(data);
        } catch (IOException e) {
            log.error("Could not read properties from file {}", path, e);
            throw new ConfigException("Could not read properties from file " + path);
        }
    }

    /**
     * Retrieves the data with the given keys at the given Properties file.
     *
     * @param path the file where the data resides
     * @param keys the keys whose values will be retrieved
     * @return the configuration data
     */
    public ConfigData get(String path, Set<String> keys) {
        if (allowedPaths == null) {
            throw new IllegalStateException("The provider has not been configured yet.");
        }

        Map<String, String> data = new HashMap<>();
        if (path == null || path.isEmpty()) {
            return new ConfigData(data);

View on GitHub (pinned to c31c9215e1)

Solutions

1. Verify the file exists and is a regular file at the exact path printed in the message (watch for trailing whitespace/newlines copied into the config value).
2. Check the kafka/connect process uid has read permission on the file and every parent directory: ls -l and namei -l <path>.
3. Confirm the path is permitted by the allowed.paths config of the FileConfigProvider; if it is not, the provider logs a separate 'not allowed' warning and returns empty data rather than throwing, so a throw here means the path passed the allow-list but failed I/O.
4. Inspect the surrounding log line for the underlying IOException (NoSuchFileException, AccessDeniedException, MalformedInputException) which carries the true root cause.
5. If the file is produced by another container/secret injector, ensure that step completes (and fsyncs) before the worker starts, or move the secret to an env-var/Kubernetes secret that the provider can read at runtime.

Example fix

// before: relative path that resolves against the worker cwd
config.providers.file.param.path=secrets.properties

// after: absolute path owned by the worker uid
config.providers.file.param.path=/etc/kafka/secrets/secrets.properties

java.nio.file.Path p = java.nio.file.Paths.get(path);
if (path == null || path.isEmpty() || !java.nio.file.Files.exists(p) || !java.nio.file.Files.isReadable(p)) {
    // skip or fail-fast before calling provider.get(path)
}

import org.apache.kafka.common.config.ConfigException;
try {
    ConfigData data = provider.get(path);
} catch (ConfigException e) {
    // message: "Could not read properties from file <path>"
    // log, fall back to defaults, or alert an operator that the file is missing/unreadable
}

When it happens

Trigger: Calling FileConfigProvider.get(path) (directly, or indirectly via a ${file:...} placeholder in worker/connector/client config) where the path resolves through AllowedPaths.parseUntrustedPath to a file that does not exist, is not readable by the process, is a directory, or contains bytes that break Properties.load (e.g. malformed UTF-8 / truncated). The exception is only raised after allowedPaths has been configured and the path passes the allow-list check.

Common situations: Typo or stale path in a ${file:/var/run/kafka/...} externalized secret; the referenced file is missing because the secret-mounting sidecar/init container has not run yet; file exists but the kafka connect worker runs as a different uid without read permission; relative path resolved against an unexpected working directory; symlink chain broken in a containerized deployment; file written but still being streamed when the worker reads it.

Related errors

• Could not load config provider class or one of its dependenc
• At least one valid string must be provided when empty values
• Failed to check internal API usage: {errorMessage}
• Failed to check public API: {errorMessage}
• Failed to check internal API usage: {errorMessage}

AI-assisted analysis of apache/kafka@c31c9215e1 (2026-08-03). Data as JSON: /data/errors/08a4a7a1bb7845d7.json. Report an issue: GitHub.