{"record":{"id":"876397ebe0c04de1","repo":"weaviate/weaviate","slug":"auth-broker-returned-non-200-status-d","errorCode":null,"errorMessage":"auth broker returned non-200 status: %d","messagePattern":"auth broker returned non-200 status: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/modulecomponents/awscommon/auth_broker.go","lineNumber":166,"sourceCode":"\t}\n\n\treq.Header.Set(\"Authorization\", fmt.Sprintf(\"Bearer %s\", identityToken))\n\n\tresp, err := b.client.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%w: %w\", ErrRetryableAuthBroker, err)\n\t}\n\tdefer func() {\n\t\t_, _ = io.Copy(io.Discard, resp.Body)\n\t\tresp.Body.Close()\n\t}()\n\n\tif resp.StatusCode >= 500 || resp.StatusCode == http.StatusTooManyRequests {\n\t\treturn nil, fmt.Errorf(\"%w: auth broker returned status %d\", ErrRetryableAuthBroker, resp.StatusCode)\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"auth broker returned non-200 status: %d\", resp.StatusCode)\n\t}\n\n\tvar creds AuthBrokerCredentialValue\n\tif err := json.NewDecoder(resp.Body).Decode(&creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode auth broker response: %w\", err)\n\t}\n\n\tif creds.AccessKeyID == \"\" || creds.SecretAccessKey == \"\" || creds.SessionToken == \"\" || creds.Expiration.IsZero() {\n\t\treturn nil, errors.New(\"auth broker response missing required fields (access_key_id, secret_access_key, session_token, expiration)\")\n\t}\n\n\treturn &creds, nil\n}\n\nfunc (b *AuthBrokerCredentials) readIdentityToken() (string, error) {\n\ttok, err := os.ReadFile(b.identityTokenPath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read web identity token from %q: %w\", b.identityTokenPath, err)","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/modulecomponents/awscommon/auth_broker.go#L148-L184","documentation":"fetchCredentials returns this plain (non-wrapped) error when the auth broker responds with any status that is neither 200 nor retryable (5xx/429). It is deliberately not retryable, so fetchCredentialsWithRetry fails fast.","triggerScenarios":"fetchCredentials gets a response with StatusCode < 500, != 429, and != 200 — e.g. 401 (rejected bearer token), 403, 404 (wrong path).","commonSituations":"Stale or empty web identity token file after kubelet rotation yields 401; misconfigured broker URL path yields 404; service account lacks permission for the role (403).","solutions":["Check the status code in the message: 401/403 means fix the IRSA token or service-account role binding","404: correct the auth broker URL/path in configuration","If 401 due to rotation, trigger a credential re-fetch after the token file is refreshed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-flight: ensure the broker endpoint is reachable and returns 200\nresp, err := http.Get(brokerURL + \"/health\")\nif err != nil || resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"auth broker unhealthy (status %v)\", resp)\n}","typeGuard":null,"tryCatchPattern":"creds, err := fetchCredentials(ctx)\nif err != nil {\n    // non-200: not retryable — inspect code in message and fix config/token\n    return fmt.Errorf(\"credential fetch failed permanently: %w\", err)\n}","preventionTips":["Verify broker URL/path in configuration before deploying","Ensure the service account's projected token is valid and role binding is correct","Add a startup health check against the broker endpoint"],"tags":["aws","auth-broker","http-status","not-retryable"],"backgroundTag":"auth-broker-non-200","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}