apache/pulsar · error · IllegalArgumentException

Couldn't get the access key secret.

Error message

Couldn't get the access key secret.

What it means

Companion error to the access key id check: thrown by the Aliyun OSS credential builder when the access key secret is absent from the environment. ACCESS_KEY_SECRET is tried first, then ALIYUN_OSS_ACCESS_KEY_SECRET; if both are blank, IllegalArgumentException is thrown even though the key id was found.

Source

Thrown at tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java:468

            }
            Credentials credentials = new Credentials(configId, configSecret);
            config.setProviderCredentials(() -> credentials);
            return;
        }
        String accountName = System.getenv().getOrDefault("ACCESS_KEY_ID", "");
        // For forward compatibility
        if (StringUtils.isEmpty(accountName.trim())) {
            accountName = System.getenv().getOrDefault("ALIYUN_OSS_ACCESS_KEY_ID", "");
        }
        if (StringUtils.isEmpty(accountName.trim())) {
            throw new IllegalArgumentException("Couldn't get the access key id.");
        }
        String accountKey = System.getenv().getOrDefault("ACCESS_KEY_SECRET", "");
        if (StringUtils.isEmpty(accountKey.trim())) {
            accountKey = System.getenv().getOrDefault("ALIYUN_OSS_ACCESS_KEY_SECRET", "");
        }
        if (StringUtils.isEmpty(accountKey.trim())) {
            throw new IllegalArgumentException("Couldn't get the access key secret.");
        }
        Credentials credentials = new Credentials(
                accountName, accountKey);
        config.setProviderCredentials(() -> credentials);
    };

}

View on GitHub (pinned to 820761864e)

Solutions

1. Export ACCESS_KEY_SECRET (or ALIYUN_OSS_ACCESS_KEY_SECRET) alongside the key id and restart the broker.
2. Fix the K8s Secret/docker env file so both keys are present.
3. Or configure both id and secret via the S3 config-property path instead of environment variables.
4. Verify with a shell into the broker pod/container that the var is non-empty for the process user.

Example fix

// before
export ACCESS_KEY_ID=LTAI...
// after
export ACCESS_KEY_ID=LTAI...
export ACCESS_KEY_SECRET=...

String secret = System.getenv("ACCESS_KEY_SECRET");
if (secret == null || secret.trim().isEmpty()) {
    secret = System.getenv("ALIYUN_OSS_ACCESS_KEY_SECRET");
}
if (secret == null || secret.trim().isEmpty()) {
    throw new IllegalStateException("OSS offload requires ACCESS_KEY_SECRET (or ALIYUN_OSS_ACCESS_KEY_SECRET) in the environment");
}

try {
    provider.validateConfig(cfg);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Couldn't get the access key secret")) {
        log.error("OSS access key secret missing from environment; set ACCESS_KEY_SECRET and restart", e);
    }
}

When it happens

Trigger: ACCESS_KEY_ID is set but neither ACCESS_KEY_SECRET nor ALIYUN_OSS_ACCESS_KEY_SECRET is present (or blank) in the broker environment when initializing OSS offload credentials.

Common situations: Only the id variable exported during secret rotation; K8s secret mounted with only one key; copy-paste of the env block stopped at the id line; secret value rendered empty by templating.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Couldn't get the access key id.
• Timeout during mark-delete operation
• Timeout during clear backlog operation
• Timeout during skip messages operation
• Both ${S3_ID_FIELD} and ${S3_SECRET_FIELD} must be set when

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/7b563169504a0b4b. Report an issue: GitHub.