apache/kafka · error · ConfigException

Path normalisedPath does not exist

Error message

Path normalisedPath does not exist

What it means

Thrown by AllowedPaths.getAllowedPaths() when a configured allowed.paths entry passes the isAbsolute() check but does not exist on the filesystem (Files.exists returns false). The check happens at provider configure() time so missing directories are caught before any externalized config lookup is attempted.

Source

Thrown at clients/src/main/java/org/apache/kafka/common/config/internals/AllowedPaths.java:51

     * Constructs AllowedPaths with a list of Paths retrieved from {@code configValue}.
     * @param configValue {@code allowed.paths} config value which is a string containing comma separated list of paths
     * @throws ConfigException if any of the given paths is not absolute or does not exist.
     */
    public AllowedPaths(String configValue) {
        this.allowedPaths = getAllowedPaths(configValue);
    }

    private List<Path> getAllowedPaths(String configValue) {
        if (configValue != null && !configValue.isEmpty()) {
            List<Path> allowedPaths = new ArrayList<>();

            Arrays.stream(configValue.split(",")).forEach(b -> {
                Path normalisedPath = Paths.get(b).normalize();

                if (!normalisedPath.isAbsolute()) {
                    throw new ConfigException("Path " + normalisedPath + " is not absolute");
                } else if (!Files.exists(normalisedPath)) {
                    throw new ConfigException("Path " + normalisedPath + " does not exist");
                } else {
                    try {
                        allowedPaths.add(normalisedPath.toRealPath());
                    } catch (IOException e) {
                        throw new ConfigException("Path " + normalisedPath + " could not be resolved", e);
                    }
                }
            });

            return allowedPaths;
        }

        return null;
    }

    /**
     * Checks if the given {@code path} resides in the configured {@code allowed.paths}.
     * If {@code allowed.paths} is not configured, the given Path is returned as allowed.

View on GitHub (pinned to c31c9215e1)

Solutions

1. Verify the path exists on the host/container with ls -ld <path>.
2. Fix typos or correct the host-specific absolute path in allowed.paths.
3. If using containers, confirm the volume/mount is present and the entrypoint runs after mounts are ready.
4. Create the directory (mkdir -p) if it is legitimately absent but expected.

Example fix

# before
allowed.paths=/etc/kafka/secrets  # path missing

# after
mkdir -p /etc/kafka/secrets
allowed.paths=/etc/kafka/secrets

// Probe existence before AllowedPaths construction:
for (String raw : configValue.split(",")) {
    Path p = Paths.get(raw.trim()).normalize();
    if (!Files.exists(p)) {
        throw new IllegalArgumentException(
            "allowed.paths entry '" + p + "' does not exist");
    }
}

try {
    AllowedPaths ap = new AllowedPaths(configValue);
} catch (ConfigException e) {
    if (e.getMessage().endsWith("does not exist")) {
        // log, create the dir/file, or degrade gracefully
    } else { throw e; }
}

When it happens

Trigger: Constructing AllowedPaths / configuring DirectoryConfigProvider or FileConfigProvider with an absolute path that does not exist on the host (typo, wrong host, not yet mounted).

Common situations: Secrets directory not mounted yet in a container (Kubernetes volumeMount not ready). Typo in an absolute path. Deploying a config referencing a path that exists in staging but not in production. Wrong user/namespace so the mount path differs.

Related errors

• Path normalisedPath could not be resolved
• Path normalisedPath is not absolute
• Could not load config provider class or one of its dependenc
• Could not list directory {dir}
• Could not read file {path} for property {fileName}

AI-assisted analysis of apache/kafka@c31c9215e1 (2026-08-03). Data as JSON: /data/errors/90b92c47e3064fd6.json. Report an issue: GitHub.