jaegertracing/jaeger · error

failed to load password from file: %w

Error message

failed to load password from file: %w

What it means

When basic auth is configured with a password file, the client loads (and periodically reloads) the password via TokenProviderWithTime. If that provider cannot be initialized — typically because the file is missing or unreadable — initBasicAuthWithTime wraps the failure with this error and client creation aborts.

Source

Thrown at internal/storage/elasticsearch/esclient/auth_helper.go:102

		return nil, nil
	}

	if basicAuth.Password != "" && basicAuth.PasswordFilePath != "" {
		return nil, errors.New("both Password and PasswordFilePath are set")
	}

	username := basicAuth.Username
	if username == "" {
		return nil, nil
	}

	var tokenFn func() string
	// Handle password from file or static password
	if basicAuth.PasswordFilePath != "" {
		// Use TokenProvider for password loading
		passwordFn, err := auth.TokenProviderWithTime(basicAuth.PasswordFilePath, basicAuth.ReloadInterval, logger, timeFn)
		if err != nil {
			return nil, fmt.Errorf("failed to load password from file: %w", err)
		}

		// Pre-encode credentials in TokenFn
		tokenFn = func() string {
			password := passwordFn()
			if password == "" {
				return ""
			}
			credentials := username + ":" + password
			return base64.StdEncoding.EncodeToString([]byte(credentials))
		}
	} else {
		// Static password - pre-encode once
		password := basicAuth.Password
		credentials := username + ":" + password
		encodedCredentials := base64.StdEncoding.EncodeToString([]byte(credentials))
		tokenFn = func() string { return encodedCredentials }
	}

View on GitHub (pinned to 806f444784)

Solutions

1. Verify the file exists and is readable by the Jaeger process at the configured path
2. Fix the secret/volume mount so the path is populated
3. Correct the password file path in the config
4. Check ReloadInterval config and logs for the underlying reload error

Example fix

// before
basic_auth:
  password_path: /secrets/es-password.txt   # not mounted
// after
basic_auth:
  password_path: /mnt/secrets/es-password.txt  # mounted secret

path := cfg.BasicAuth.PasswordFilePath
if path != "" {
    f, err := os.Open(path)
    if err != nil {
        return fmt.Errorf("password file not readable at %s: %w", path, err)
    }
    f.Close()
}

When it happens

Trigger: Setting PasswordFilePath in the basic-auth config to a path that TokenProviderWithTime cannot read (nonexistent file, bad permissions, bad directory) while initializing basic auth during client setup.

Common situations: Kubernetes secret not mounted at the expected path; file exists at startup but the mount changed; typo in the password file path; permissions too strict for the process user.

Related errors

• file must begin with '['
• max spans count reached
• empty configuration
• at least one storage backend is required
• cannot assign unique span ID, too many spans in the trace

AI-assisted analysis of jaegertracing/jaeger@806f444784 (2026-09-01). Data as JSON: /api/errors/ce1a27f8714b4ba8. Report an issue: GitHub.