apache/pulsar · error · IllegalArgumentException

Cannot read GCS service account credentials file (wraps IOEx

Error message

Cannot read GCS service account credentials file (wraps IOException for gcsManagedLedgerOffloadServiceAccountKeyFile)

What it means

GCS offload provider failed to read the service-account key file configured by gcsManagedLedgerOffloadServiceAccountKeyFile; the resulting IOException is wrapped because the credentials for the GCS blob store cannot be loaded.

Source

Thrown at tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java:126

        @Override
        public BlobStore getBlobStore(TieredStorageConfiguration config) {
            return BLOB_STORE_BUILDER.getBlobStore(config);
        }

        @Override
        public void buildCredentials(TieredStorageConfiguration config) {
            if (config.getCredentials() == null) {
                try {
                    String gcsKeyContent = Files.asCharSource(
                            new File(config.getConfigProperty(GCS_ACCOUNT_KEY_FILE_FIELD)),
                            Charset.defaultCharset()).read();
                    config.setProviderCredentials(() -> new GoogleCredentialsFromJson(gcsKeyContent).get());
                } catch (IOException ioe) {
                    log.error().attr("file",
                            config.getConfigProperty("gcsManagedLedgerOffloadServiceAccountKeyFile"))
                            .log("Cannot read GCS service account credentials file");
                    throw new IllegalArgumentException(ioe);
                }
            }
        }
    },

    AZURE_BLOB("azureblob", new AzureBlobProviderMetadata()) {
        @Override
        public void validate(TieredStorageConfiguration config) throws IllegalArgumentException {
            VALIDATION.validate(config);
        }

        @Override
        public BlobStore getBlobStore(TieredStorageConfiguration config) {
            ContextBuilder contextBuilder = ContextBuilder.newBuilder(config.getProviderMetadata());
            ShadedJCloudsUtils.addStandardModules(contextBuilder);
            contextBuilder.overrides(config.getOverrides());

            if (config.getProviderCredentials() != null) {

View on GitHub (pinned to 820761864e)

Solutions

1. Verify the key file path exists and is readable
2. Ensure the JSON key file is a valid GCS service-account credential

When it happens

Trigger: Thrown at tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java:126 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/c9336a59c968d8ee. Report an issue: GitHub.