{"record":{"id":"c718a429b9ab1632","repo":"apache/iceberg","slug":"failed-to-get-rrsa-credentials","errorCode":null,"errorMessage":"Failed to get RRSA credentials","messagePattern":"Failed to get RRSA credentials","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"aliyun/src/main/java/org/apache/iceberg/aliyun/AliyunClientFactories.java","lineNumber":159,"sourceCode":"                public Credentials getCredentials() {\n                  try {\n                    LOG.debug(\"Getting credentials using RRSA\");\n                    // getCredentials() returns cached credentials and auto-refreshes when needed\n                    CredentialModel cred = oidcProvider.getCredentials();\n                    long expirationSeconds = 0;\n                    if (cred.getExpiration() > 0) {\n                      expirationSeconds =\n                          (cred.getExpiration() - System.currentTimeMillis()) / 1000;\n                    }\n                    this.currentCredentials =\n                        new BasicCredentials(\n                            cred.getAccessKeyId(),\n                            cred.getAccessKeySecret(),\n                            cred.getSecurityToken(),\n                            expirationSeconds);\n                    return this.currentCredentials;\n                  } catch (Exception e) {\n                    throw new RuntimeException(\"Failed to get RRSA credentials\", e);\n                  }\n                }\n              };\n          return new OSSClientBuilder().build(endpoint, ossCredProvider);\n        } catch (Exception e) {\n          throw new RuntimeException(\"Failed to create RRSA OSS client\", e);\n        }\n      } else if (Strings.isNullOrEmpty(aliyunProperties.securityToken())) {\n        return new OSSClientBuilder()\n            .build(\n                aliyunProperties.ossEndpoint(),\n                aliyunProperties.accessKeyId(),\n                aliyunProperties.accessKeySecret());\n      } else {\n        return new OSSClientBuilder()\n            .build(\n                aliyunProperties.ossEndpoint(),\n                aliyunProperties.accessKeyId(),","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/aliyun/src/main/java/org/apache/iceberg/aliyun/AliyunClientFactories.java#L141-L177","documentation":"When RRSA (RAM Roles for Service Accounts) authentication is configured, the OSS credential provider fetches temporary STS credentials via the Alibaba Cloud SDK. Any exception during that credential fetch is wrapped in this RuntimeException(\"Failed to get RRSA credentials\", e). The root cause chain holds the underlying SDK error.","triggerScenarios":"Calling newOSSClient (via AliyunClientFactories.client) with RRSA enabled: missing/mis-set OIDC provider ARN, role ARN, or session name properties; network failure calling Alibaba STS; the pod not actually running under the annotated service account so AssumeRoleWithOIDC is rejected.","commonSituations":"K8s pods using ACK RRSA where the service account annotations are wrong or removed; expired/rotated OIDC provider; STS endpoint unreachable from the cluster network; clock skew invalidating token.","solutions":["Inspect the cause chain (e.getCause()) for the actual STS error — fix the specific RRSA property (oidc-provider-arn, role-arn, session-name) it reports.","Verify the Kubernetes service account is annotated with the correct role ARN and the pod uses that service account.","Check cluster network egress to the STS/OIDC endpoints.","Re-check the RRSA setup in ACK (role trust policy must allow the OIDC provider and sa namespace/sa name)."],"exampleFix":"// before (incomplete props)\nconf.set(\"io.manifest.cache-credential-oidc-provider-arn\", \"\");\n\n// after\nconf.set(\"...oidc-provider-arn\", \"acs:ram::123:oidc-provider/ack-rrsa\");\nconf.set(\"...role-arn\", \"acs:ram::123:role/iceberg-rrsa\");\nconf.set(\"...session-name\", \"iceberg\");","handlingStrategy":"try-catch","validationCode":"// Before starting the job, verify RRSA props are present:\nassert !oidcProviderArn.isEmpty() && !roleArn.isEmpty() && !sessionName.isEmpty();\n// And that the pod has a projected OIDC service account token:\nFiles.exists(Path.of(\"/var/run/secrets/eks...or ACK oidc token path\"));","typeGuard":null,"tryCatchPattern":"try {\n  Table table = catalog.loadTable(identifier);\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Failed to get RRSA credentials\")) {\n    // inspect e.getCause(), refresh RRSA config, then retry with backoff\n  }\n}","preventionTips":["Validate RRSA properties (OIDC provider ARN, role ARN, session name) at job startup.","Ensure the K8s service account annotations and role trust policy match namespace/SA name.","Add retry with backoff around client creation for transient STS errors.","Monitor cluster egress to STS endpoints."],"tags":["aliyun","authentication","sts","network"],"backgroundTag":"authentication-required","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}