{"record":{"id":"ce1a27f8714b4ba8","repo":"jaegertracing/jaeger","slug":"failed-to-load-password-from-file-w","errorCode":null,"errorMessage":"failed to load password from file: %w","messagePattern":"failed to load password from file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/storage/elasticsearch/esclient/auth_helper.go","lineNumber":102,"sourceCode":"\t\treturn nil, nil\n\t}\n\n\tif basicAuth.Password != \"\" && basicAuth.PasswordFilePath != \"\" {\n\t\treturn nil, errors.New(\"both Password and PasswordFilePath are set\")\n\t}\n\n\tusername := basicAuth.Username\n\tif username == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tvar tokenFn func() string\n\t// Handle password from file or static password\n\tif basicAuth.PasswordFilePath != \"\" {\n\t\t// Use TokenProvider for password loading\n\t\tpasswordFn, err := auth.TokenProviderWithTime(basicAuth.PasswordFilePath, basicAuth.ReloadInterval, logger, timeFn)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load password from file: %w\", err)\n\t\t}\n\n\t\t// Pre-encode credentials in TokenFn\n\t\ttokenFn = func() string {\n\t\t\tpassword := passwordFn()\n\t\t\tif password == \"\" {\n\t\t\t\treturn \"\"\n\t\t\t}\n\t\t\tcredentials := username + \":\" + password\n\t\t\treturn base64.StdEncoding.EncodeToString([]byte(credentials))\n\t\t}\n\t} else {\n\t\t// Static password - pre-encode once\n\t\tpassword := basicAuth.Password\n\t\tcredentials := username + \":\" + password\n\t\tencodedCredentials := base64.StdEncoding.EncodeToString([]byte(credentials))\n\t\ttokenFn = func() string { return encodedCredentials }\n\t}","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/jaegertracing/jaeger/blob/806f4447841ecdb60519f408b004a599d515f437/internal/storage/elasticsearch/esclient/auth_helper.go#L84-L120","documentation":"When basic auth is configured with a password file, the client loads (and periodically reloads) the password via TokenProviderWithTime. If that provider cannot be initialized — typically because the file is missing or unreadable — initBasicAuthWithTime wraps the failure with this error and client creation aborts.","triggerScenarios":"Setting PasswordFilePath in the basic-auth config to a path that TokenProviderWithTime cannot read (nonexistent file, bad permissions, bad directory) while initializing basic auth during client setup.","commonSituations":"Kubernetes secret not mounted at the expected path; file exists at startup but the mount changed; typo in the password file path; permissions too strict for the process user.","solutions":["Verify the file exists and is readable by the Jaeger process at the configured path","Fix the secret/volume mount so the path is populated","Correct the password file path in the config","Check ReloadInterval config and logs for the underlying reload error"],"exampleFix":"// before\nbasic_auth:\n  password_path: /secrets/es-password.txt   # not mounted\n// after\nbasic_auth:\n  password_path: /mnt/secrets/es-password.txt  # mounted secret","handlingStrategy":"validation","validationCode":"path := cfg.BasicAuth.PasswordFilePath\nif path != \"\" {\n    f, err := os.Open(path)\n    if err != nil {\n        return fmt.Errorf(\"password file not readable at %s: %w\", path, err)\n    }\n    f.Close()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify secret mounts before startup (init container check)","Use stable, documented mount paths","Test permission access as the Jaeger process user"],"tags":["elasticsearch","authentication","file-io"],"backgroundTag":"password-file-unreadable","analyzedSha":"806f4447841ecdb60519f408b004a599d515f437","analyzedAt":"2026-09-01T02:39:22.140Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}