What causes "credential file cannot be inspected" in iflytek/astron-agent?

Verify the credential file path exists and is on a stable local filesystem

credential file cannot be inspected

Error message

credential file cannot be inspected

What it means

readCredentialFile returns this generic error when os.File.Stat() fails after the credential file was successfully opened, meaning the file's metadata (type, size, permissions) cannot be inspected. This is a defensive path — it usually indicates a race on the file or an exotic filesystem.

Solutions

Verify the credential file path exists and is on a stable local filesystem
Re-mount or recreate the secret volume if it was deleted mid-read
Retry the deployment; if persistent, check node/disk logs for I/O errors

Defensive patterns

Strategy: try-catch

Validate before calling

info, err := os.Stat(path)
if err != nil {
    return fmt.Errorf("credential path %s not statable: %w", path, err)
}

Try / catch

if _, err := config.LoadTenantBootstrapCredentials(ctx); err != nil {
    if strings.Contains(err.Error(), "cannot be inspected") {
        logger.Error("credential file stat failed; check mount stability", "err", err)
        return retry.AfterDelay(err, time.Second)
    }
    return err
}

Prevention

Mount credential files on stable local storage, not NFS
Avoid swapping Kubernetes secret volumes mid-read; use atomic updates
Alert on repeated startup failures mentioning inspection/read errors

When it happens

Trigger: credentialFromEnvironmentOrFile opens the credential file (e.g. TENANT_KEY_FILE path) and calls Stat(); the Stat call returns an error (file deleted between open and stat, I/O error, unsupported filesystem), producing this error.

Common situations: Kubernetes-mounted secret being swapped/remounted while the service reads it, NFS/ephemeral volume hiccups, or the credential path pointing at a device/pipe that misbehaves on stat.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/5b6175ff62d7f948. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/config/bootstrap_credentials.go:117

	}
	if err := validateCredential(valueEnvironment, value); err != nil {
		return "", err
	}
	return value, nil
}

func readCredentialFile(fileName string) (string, error) {
	file, err := openCredentialFileNoFollow(fileName)
	if err != nil {
		return "", err
	}
	defer func() {
		_ = file.Close()
	}()

	openedInfo, err := file.Stat()
	if err != nil {
		return "", errors.New("credential file cannot be inspected")
	}
	if !openedInfo.Mode().IsRegular() {
		return "", errors.New("credential file must be a regular non-symbolic-link file")
	}
	if openedInfo.Size() > maxCredentialFileBytes {
		return "", errors.New("credential file is too large")
	}

	data, err := io.ReadAll(io.LimitReader(file, maxCredentialFileBytes+1))
	if err != nil {
		return "", errors.New("credential file cannot be read")
	}
	if len(data) > maxCredentialFileBytes {
		return "", errors.New("credential file is too large")
	}
	return strings.TrimSpace(string(data)), nil
}

View on GitHub (pinned to 5e758547a8)