{"record":{"id":"d304ec24478333dc","repo":"openai/openai-python","slug":"the-token-file-at-token-file-path-is-empty","errorCode":null,"errorMessage":"The token file at {token_file_path} is empty.","messagePattern":"The token file at (.+?) is empty\\.","errorType":"exception","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":95,"sourceCode":"\ndef k8s_service_account_token_provider(\n    token_file_path: str | Path = \"/var/run/secrets/kubernetes.io/serviceaccount/token\",\n) -> SubjectTokenProvider:\n    \"\"\"\n    Get a subject token provider for Kubernetes clusters with Workload Identity configured.\n\n    Cloud providers typically mount the subject token as a file in the container.\n\n    Args:\n        token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.\n    \"\"\"\n\n    def get_token() -> str:\n        try:\n            with open(token_file_path, \"r\") as f:\n                token = f.read().strip()\n                if not token:\n                    raise SubjectTokenProviderError(f\"The token file at {token_file_path} is empty.\")\n                return token\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to read the token file at {token_file_path}: {e}\") from e\n\n    return {\"token_type\": \"jwt\", \"get_token\": get_token}\n\n\ndef azure_managed_identity_token_provider(\n    resource: str = \"https://management.azure.com/\",\n    *,\n    object_id: str | None = None,\n    client_id: str | None = None,\n    msi_res_id: str | None = None,\n    api_version: str = \"2018-02-01\",\n    timeout: float = 10.0,\n    http_client: httpx2.Client | None = None,\n) -> SubjectTokenProvider:\n    \"\"\"","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L77-L113","documentation":"Part of the workload-identity (Kubernetes service account) token provider: it reads the projected service-account token file and treats an empty-or-whitespace-only file as a hard error. This means the token volume was mounted but the kubelet never projected a token into it (or it was truncated), so workload identity authentication cannot proceed.","triggerScenarios":"Running with credential='workload' (or the k8s workload identity flow) where the token file referenced by the provider config exists but is empty — misconfigured projected volume, race at pod startup before token projection, or a manually created empty file.","commonSituations":"Kubernetes projected service-account token volumes not yet populated at startup; wrong file path pointing at an empty mounted file; using workload identity outside a properly configured cluster; CI containers faking the token file.","solutions":["Verify the file has content: kubectl exec ... -- cat <path>; fix the projected volume configuration","Add a startup wait/retry until the token file is non-empty before creating the client","Correct the token file path to the actual projected token location (/var/run/secrets/tokens/... or the kubelet default)","If not on Kubernetes with projected tokens, switch to another credential type"],"exampleFix":"# before\nclient = OpenAI(credential=\"workload\")  # token file empty at startup\n\n# after\nimport time\nfrom openai.auth import k8s_service_account_token_provider  # adjust to actual API\nfor _ in range(30):\n    if open(TOKEN_PATH).read().strip(): break\n    time.sleep(1)\nclient = OpenAI(credential=k8s_service_account_token_provider(TOKEN_PATH))","handlingStrategy":"validation","validationCode":"with open(TOKEN_PATH) as f:\n    token = f.read().strip()\nif not token:\n    wait_for_token_projection()","typeGuard":"def token_file_ready(path: str) -> bool:\n    import os\n    try:\n        return bool(open(path).read().strip())\n    except OSError:\n        return False","tryCatchPattern":"try:\n    client.chat.completions.create(...)\nexcept SubjectTokenProviderError as e:\n    if \"is empty\" in str(e): wait_and_reinit_client()","preventionTips":["Retry-loop on token file presence at pod startup","Configure the projected volume correctly","Log the token file path in deployment debug output"],"tags":["kubernetes","workload-identity","auth","token-file"],"backgroundTag":"workload-identity-token-missing","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}