{"record":{"id":"5b6175ff62d7f948","repo":"iflytek/astron-agent","slug":"credential-file-cannot-be-inspected","errorCode":null,"errorMessage":"credential file cannot be inspected","messagePattern":"credential file cannot be inspected","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/tenant/config/bootstrap_credentials.go","lineNumber":117,"sourceCode":"\t}\n\tif err := validateCredential(valueEnvironment, value); err != nil {\n\t\treturn \"\", err\n\t}\n\treturn value, nil\n}\n\nfunc readCredentialFile(fileName string) (string, error) {\n\tfile, err := openCredentialFileNoFollow(fileName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer func() {\n\t\t_ = file.Close()\n\t}()\n\n\topenedInfo, err := file.Stat()\n\tif err != nil {\n\t\treturn \"\", errors.New(\"credential file cannot be inspected\")\n\t}\n\tif !openedInfo.Mode().IsRegular() {\n\t\treturn \"\", errors.New(\"credential file must be a regular non-symbolic-link file\")\n\t}\n\tif openedInfo.Size() > maxCredentialFileBytes {\n\t\treturn \"\", errors.New(\"credential file is too large\")\n\t}\n\n\tdata, err := io.ReadAll(io.LimitReader(file, maxCredentialFileBytes+1))\n\tif err != nil {\n\t\treturn \"\", errors.New(\"credential file cannot be read\")\n\t}\n\tif len(data) > maxCredentialFileBytes {\n\t\treturn \"\", errors.New(\"credential file is too large\")\n\t}\n\treturn strings.TrimSpace(string(data)), nil\n}\n","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/config/bootstrap_credentials.go#L99-L135","documentation":"readCredentialFile returns this generic error when os.File.Stat() fails after the credential file was successfully opened, meaning the file's metadata (type, size, permissions) cannot be inspected. This is a defensive path — it usually indicates a race on the file or an exotic filesystem.","triggerScenarios":"credentialFromEnvironmentOrFile opens the credential file (e.g. TENANT_KEY_FILE path) and calls Stat(); the Stat call returns an error (file deleted between open and stat, I/O error, unsupported filesystem), producing this error.","commonSituations":"Kubernetes-mounted secret being swapped/remounted while the service reads it, NFS/ephemeral volume hiccups, or the credential path pointing at a device/pipe that misbehaves on stat.","solutions":["Verify the credential file path exists and is on a stable local filesystem","Re-mount or recreate the secret volume if it was deleted mid-read","Retry the deployment; if persistent, check node/disk logs for I/O errors"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"info, err := os.Stat(path)\nif err != nil {\n    return fmt.Errorf(\"credential path %s not statable: %w\", path, err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := config.LoadTenantBootstrapCredentials(ctx); err != nil {\n    if strings.Contains(err.Error(), \"cannot be inspected\") {\n        logger.Error(\"credential file stat failed; check mount stability\", \"err\", err)\n        return retry.AfterDelay(err, time.Second)\n    }\n    return err\n}","preventionTips":["Mount credential files on stable local storage, not NFS","Avoid swapping Kubernetes secret volumes mid-read; use atomic updates","Alert on repeated startup failures mentioning inspection/read errors"],"tags":["filesystem","credentials","io"],"backgroundTag":"file-read-failed","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}