{"record":{"id":"2ab338265ad32b27","repo":"apache/iceberg","slug":"failed-to-load-google-credentials","errorCode":null,"errorMessage":"Failed to load Google credentials","messagePattern":"Failed to load Google credentials","errorType":"exception","errorClass":"UncheckedIOException","httpStatus":null,"severity":"error","filePath":"gcp/src/main/java/org/apache/iceberg/gcp/auth/GoogleAuthManager.java","lineNumber":118,"sourceCode":"\n    try {\n      if (useCredentialsPath) {\n        LOG.info(\"Using Google credentials from path: {}\", credentialsPath);\n        try (FileInputStream credentialsStream = new FileInputStream(credentialsPath)) {\n          this.credentials = GoogleCredentials.fromStream(credentialsStream).createScoped(scopes);\n        }\n      } else if (useCredentialsJson) {\n        LOG.info(\"Using Google credentials from json\");\n        try (InputStream credentialsStream =\n            new ByteArrayInputStream(credentialsJson.getBytes(StandardCharsets.UTF_8))) {\n          this.credentials = GoogleCredentials.fromStream(credentialsStream).createScoped(scopes);\n        }\n      } else {\n        LOG.info(\"Using Application Default Credentials with scopes: {}\", scopesString);\n        this.credentials = GoogleCredentials.getApplicationDefault().createScoped(scopes);\n      }\n    } catch (IOException e) {\n      throw new UncheckedIOException(\"Failed to load Google credentials\", e);\n    }\n\n    this.initialized = true;\n  }\n\n  /**\n   * Initializes and returns a short-lived session, typically for fetching configuration. This\n   * implementation reuses the long-lived catalog session logic.\n   */\n  @Override\n  public AuthSession initSession(RESTClient initClient, Map<String, String> properties) {\n    return catalogSession(initClient, properties);\n  }\n\n  /**\n   * Returns a long-lived session tied to the catalog's lifecycle. This session uses Google\n   * Application Default Credentials or a specified service account.\n   *","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/gcp/src/main/java/org/apache/iceberg/gcp/auth/GoogleAuthManager.java#L100-L136","documentation":"GoogleAuthManager.initialize loads Google credentials (service-account file/JSON or Application Default Credentials) and applies scopes. Any IOException during loading is wrapped in UncheckedIOException('Failed to load Google credentials').","triggerScenarios":"initialize() runs when the credentials file at GCP_CREDENTIALS_PATH_PROPERTY does not exist or is unreadable, the JSON is invalid, or GoogleCredentials.getApplicationDefault() finds no credential source.","commonSituations":"Wrong/relative path to the service-account key, file permissions, missing GOOGLE_APPLICATION_CREDENTIALS in the runtime container, or no workload identity on GKE.","solutions":["Verify the credentials file path exists and is readable from the process, or that ADC is configured (gcloud auth application-default login / GOOGLE_APPLICATION_CREDENTIALS)","Validate the service-account JSON is well-formed and the key is not revoked","On GCP infra, attach a service account / enable workload identity instead of shipping key files","Pre-flight credentials at startup so this surfaces before query time"],"exampleFix":"// before\nString path = properties.get(\"gcp.credentials-path\"); // file may not exist\n// after\nString path = properties.get(\"gcp.credentials-path\");\nif (path != null && !Files.isReadable(Path.of(path))) {\n  throw new IllegalArgumentException(\"Credentials file not readable: \" + path);\n}","handlingStrategy":"try-catch","validationCode":"String path = props.get(\"gcp.credentials-path\");\nif (path != null && !Files.isReadable(Path.of(path))) { throw new IllegalArgumentException(\"Unreadable credentials file: \" + path); }","typeGuard":null,"tryCatchPattern":"try { authManager.initialize(props); } catch (UncheckedIOException e) { LOG.error(\"Google credential load failed\", e.getCause()); throw e; }","preventionTips":["Validate credential file existence/permissions at deploy time","Prefer workload identity over key files on GCP","Check key validity/revocation in IAM before rollout"],"tags":["gcp","credentials","authentication","io"],"backgroundTag":"missing-credentials","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}