apache/seatunnel · error · SecurityException

Caller is not a cluster member: ${callerAddress}

Error message

Caller is not a cluster member: ${callerAddress}

What it means

GetMetricsOperation.run() is a cluster operation that fetches task metrics. It first authenticates the caller: if the caller address is null or not a registered cluster member, it throws SecurityException to reject requests from non-member nodes (potential rogue/unauthorized node).

Source

Thrown at seatunnel-engine/seatunnel-engine-server/src/main/java/org/apache/seatunnel/engine/server/task/operation/GetMetricsOperation.java:68

    public GetMetricsOperation(Set<Long> runningJobIds) {
        this.runningJobIds = runningJobIds;
    }

    public GetMetricsOperation(Set<Long> runningJobIds, String[] metricNamePrefixes) {
        this.runningJobIds = runningJobIds;
        this.metricNamePrefixes = metricNamePrefixes;
    }

    @Override
    public void run() {
        ILogger logger = getLogger();

        Address callerAddress = getCallerAddress();

        NodeEngineImpl nodeEngine = (NodeEngineImpl) getNodeEngine();
        if (callerAddress == null
                || nodeEngine.getClusterService().getMember(callerAddress) == null) {
            throw new SecurityException("Caller is not a cluster member: " + callerAddress);
        }
        Address masterAddress = getNodeEngine().getMasterAddress();
        if (!callerAddress.equals(masterAddress)) {
            throw new IllegalStateException(
                    "Caller "
                            + callerAddress
                            + " cannot get metrics"
                            + " because it is not master. Master is: "
                            + masterAddress);
        }
        Predicate<MetricDescriptor> metricDescriptorPredicate =
                dis -> {
                    String jobIdStr = dis.tagValue(JOB_ID);
                    if (jobIdStr == null) {
                        return false;
                    }
                    long jobId;
                    try {

View on GitHub (pinned to cf67b549a7)

Solutions

1. Ensure the caller node is a joined, healthy member of the same SeaTunnel cluster (check member list on both sides).
2. Verify all nodes use identical cluster discovery config (cluster name, seed addresses, network interfaces).
3. Restart the caller so it rejoins the cluster and obtains a valid membership.
4. Do not invoke internal metrics operations from outside the cluster; use the REST/Client APIs instead.

boolean isMember = nodeEngine.getClusterService().getMember(callerAddress) != null;
if (!isMember) throw new SecurityException("caller not in cluster");

try { invokeGetMetrics(); } catch (SecurityException e) { if (e.getMessage().startsWith("Caller is not a cluster member")) { rejoinClusterAndRetry(); } else { throw e; } }

When it happens

Trigger: run() invoked via Hazelcast operation dispatch where getCallerAddress() is null or nodeEngine.getClusterService().getMember(callerAddress) returns null — i.e. the operation arrives from an address not in the current member list.

Common situations: Stale client/server code invoking operations after the caller left the cluster; network misconfiguration with forged/mismatched addresses; test harness calling the operation outside a real cluster; split-brain leftovers.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Caller ${callerAddress} cannot get metrics because it is not
• Caller ${callerAddress} cannot get taskGroupLocation metrics
• Failed to load AmazonDocumentDB TLS CA bundle:
• CLUSTER_LIST_GET_FAILED
• KERBEROS_AUTHENTICATION_FAILED

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/48f7b56fe08f7158. Report an issue: GitHub.