{"record":{"id":"fd30b9568cd449f2","repo":"apache/druid","slug":"failed-to-get-current-leader-for-s","errorCode":null,"errorMessage":"Failed  to get current leader for [%s]","messagePattern":"Failed  to get current leader for \\[(.+?)\\]","errorType":"exception","errorClass":"RuntimeException (Druid RE)","httpStatus":null,"severity":"error","filePath":"extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sLeaderElectorFactory.java","lineNumber":70,"sourceCode":"    LeaderElectionConfig leaderElectionConfig =\n        new LeaderElectionConfig(\n            lock,\n            Duration.ofMillis(discoveryConfig.getLeaseDuration().getMillis()),\n            Duration.ofMillis(discoveryConfig.getRenewDeadline().getMillis()),\n            Duration.ofMillis(discoveryConfig.getRetryPeriod().getMillis())\n        );\n    LeaderElector leaderElector = new LeaderElector(leaderElectionConfig);\n\n    return new K8sLeaderElector()\n    {\n      @Override\n      public String getCurrentLeader()\n      {\n        try {\n          return lock.get().getHolderIdentity();\n        }\n        catch (ApiException ex) {\n          throw new RE(ex, \"Failed  to get current leader for [%s]\", lockResourceName);\n        }\n      }\n\n      @Override\n      public void run(Runnable startLeadingHook, Runnable stopLeadingHook)\n      {\n        leaderElector.run(startLeadingHook, stopLeadingHook);\n      }\n    };\n  }\n\n  private Lock createLock(String candidateId, String namespace, String lockResourceName, ApiClient k8sApiClient)\n  {\n    return new ConfigMapLock(\n        namespace,\n        lockResourceName,\n        candidateId,\n        k8sApiClient","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sLeaderElectorFactory.java#L52-L88","documentation":"Wraps a Kubernetes ApiException thrown while reading the holder identity of the leader-election lock (a CoordinationV1Api Lease/ConfigMap lock). The elector could not fetch the current lock object, so the current leader is unknown.","triggerScenarios":"Calling getCurrentLeader on the leader elector created by DefaultK8sLeaderElectorFactory when the underlying lock.get() request to the K8s API fails (403 RBAC, 404 missing lock object, 401 auth, network error).","commonSituations":"Service account missing get permission on the Lease/configmap used as lock; lockResourceName/namespace misconfigured; lock object deleted; transient API server errors.","solutions":["Grant the service account get on the lock resource (leases in coordination.k8s.io for the namespace).","Verify the lock resource name and namespace in druid.k8s leader-election config exist (kubectl get lease <name> -n <ns>).","Fix auth (valid service-account token) if the code is 401.","Retry on transient errors; the message identifies which lock failed via lockResourceName."],"exampleFix":"// before: kubectl auth can-i get leases.coordination.k8s.io -n druid => no\n// after: grant RBAC\nkubectl create role druid-leader --verb=get,list,watch --resource=leases.coordination.k8s.io -n druid\nkubectl create rolebinding druid-leader --role=druid-leader --serviceaccount=druid:druid-sa -n druid","handlingStrategy":"retry","validationCode":"// before electing: check lock access\nkubectl auth can-i get leases.coordination.k8s.io -n <namespace>  # must be yes\nkubectl get lease <lockResourceName> -n <namespace>              # must exist","typeGuard":null,"tryCatchPattern":"try {\n  String leader = elector.getCurrentLeader();\n} catch (RE e) {\n  if (e.getCause() instanceof ApiException && ((ApiException) e.getCause()).getCode() == 404) {\n    return null; // no leader yet\n  }\n  throw e;\n}","preventionTips":["Grant get/list/watch on leases (or the lock configmap) to the Druid service account.","Ensure lockResourceName and namespace in config match the created Lease object.","Create the Lease up-front if you don't want 404s before first election.","Retry transient API errors with backoff."],"tags":["kubernetes","leader-election","apiexception","rbac"],"backgroundTag":"http-error-response","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}