{"record":{"id":"7b563169504a0b4b","repo":"apache/pulsar","slug":"couldn-t-get-the-access-key-secret","errorCode":null,"errorMessage":"Couldn't get the access key secret.","messagePattern":"Couldn't get the access key secret\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java","lineNumber":468,"sourceCode":"            }\n            Credentials credentials = new Credentials(configId, configSecret);\n            config.setProviderCredentials(() -> credentials);\n            return;\n        }\n        String accountName = System.getenv().getOrDefault(\"ACCESS_KEY_ID\", \"\");\n        // For forward compatibility\n        if (StringUtils.isEmpty(accountName.trim())) {\n            accountName = System.getenv().getOrDefault(\"ALIYUN_OSS_ACCESS_KEY_ID\", \"\");\n        }\n        if (StringUtils.isEmpty(accountName.trim())) {\n            throw new IllegalArgumentException(\"Couldn't get the access key id.\");\n        }\n        String accountKey = System.getenv().getOrDefault(\"ACCESS_KEY_SECRET\", \"\");\n        if (StringUtils.isEmpty(accountKey.trim())) {\n            accountKey = System.getenv().getOrDefault(\"ALIYUN_OSS_ACCESS_KEY_SECRET\", \"\");\n        }\n        if (StringUtils.isEmpty(accountKey.trim())) {\n            throw new IllegalArgumentException(\"Couldn't get the access key secret.\");\n        }\n        Credentials credentials = new Credentials(\n                accountName, accountKey);\n        config.setProviderCredentials(() -> credentials);\n    };\n\n}\n","sourceCodeStart":450,"sourceCodeEnd":476,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/tiered-storage/jcloud/src/main/java/org/apache/bookkeeper/mledger/offload/jcloud/provider/JCloudBlobStoreProvider.java#L450-L476","documentation":"Companion error to the access key id check: thrown by the Aliyun OSS credential builder when the access key secret is absent from the environment. ACCESS_KEY_SECRET is tried first, then ALIYUN_OSS_ACCESS_KEY_SECRET; if both are blank, IllegalArgumentException is thrown even though the key id was found.","triggerScenarios":"ACCESS_KEY_ID is set but neither ACCESS_KEY_SECRET nor ALIYUN_OSS_ACCESS_KEY_SECRET is present (or blank) in the broker environment when initializing OSS offload credentials.","commonSituations":"Only the id variable exported during secret rotation; K8s secret mounted with only one key; copy-paste of the env block stopped at the id line; secret value rendered empty by templating.","solutions":["Export ACCESS_KEY_SECRET (or ALIYUN_OSS_ACCESS_KEY_SECRET) alongside the key id and restart the broker.","Fix the K8s Secret/docker env file so both keys are present.","Or configure both id and secret via the S3 config-property path instead of environment variables.","Verify with a shell into the broker pod/container that the var is non-empty for the process user."],"exampleFix":"// before\nexport ACCESS_KEY_ID=LTAI...\n// after\nexport ACCESS_KEY_ID=LTAI...\nexport ACCESS_KEY_SECRET=...","handlingStrategy":"validation","validationCode":"String secret = System.getenv(\"ACCESS_KEY_SECRET\");\nif (secret == null || secret.trim().isEmpty()) {\n    secret = System.getenv(\"ALIYUN_OSS_ACCESS_KEY_SECRET\");\n}\nif (secret == null || secret.trim().isEmpty()) {\n    throw new IllegalStateException(\"OSS offload requires ACCESS_KEY_SECRET (or ALIYUN_OSS_ACCESS_KEY_SECRET) in the environment\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.validateConfig(cfg);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Couldn't get the access key secret\")) {\n        log.error(\"OSS access key secret missing from environment; set ACCESS_KEY_SECRET and restart\", e);\n    }\n}","preventionTips":["Always export the secret immediately after the id in env setup scripts and manifests.","Mount K8s Secrets with both keys and inject both as env vars.","When rotating, update both variables in the same change.","If the id resolves but the secret doesn't, the pair came from different sources — unify them."],"tags":["configuration","environment-variables","aliyun-oss","credentials"],"backgroundTag":"missing-env-var","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}