pentaho/pentaho-kettle · error · KettleException

MODIFY_JOB : repository is read-only

Error message

MODIFY_JOB : repository is read-only

What it means

KettleFileRepositorySecurityProvider.validateAction() throws this KettleException when a MODIFY_JOB operation is requested but the repository is flagged read-only. Like the transformation cases, the file repository enforces only the global read-only capability.

Solutions

  1. Reconnect to the repository with read-only disabled
  2. Set readOnly=false on the KettleFileRepositoryMeta before connecting
  3. Guard job saves with capabilities.isReadOnly() checks
  4. Persist job changes to an alternative writable repository when read-only mode is deliberate

Example fix

// before
repo.save(jobMeta, "scheduled update", null); // throws when read-only
// after
if (!repo.getRepositoryCapabilities().isReadOnly()) {
  repo.save(jobMeta, "scheduled update", null);
}
Defensive patterns

Strategy: validation

Validate before calling

if (repo.getRepositoryCapabilities().isReadOnly()) {
  throw new IllegalStateException("Repository is read-only; cannot modify jobs");
}

Try / catch

try {
  repo.save(jobMeta, "comment", null);
} catch (KettleException e) {
  if (e.getMessage().contains("read-only")) {
    log.error("Job save blocked; reconnect with read-only disabled");
  }
}

Prevention

When it happens

Trigger: Calling saveJob/update of a JobMeta through a KettleFileRepository connected with read-only capabilities.

Common situations: Repository opened read-only in Spoon (user believes they have write access); code reusing a shared read-only repository instance for job updates.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/8b6ff43566764f5b. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/repository/filerep/KettleFileRepositorySecurityProvider.java:70

          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case DELETE_TRANSFORMATION:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case EXECUTE_TRANSFORMATION:
          break;
        case LOCK_TRANSFORMATION:
          break;

        case READ_JOB:
          break;
        case MODIFY_JOB:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case DELETE_JOB:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case EXECUTE_JOB:
          break;
        case LOCK_JOB:
          break;

        case MODIFY_DATABASE:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case DELETE_DATABASE:

View on GitHub (pinned to f3058517a1)