pentaho/pentaho-kettle · error · KettleException

MODIFY_TRANSFORMATION : repository is read-only

Error message

MODIFY_TRANSFORMATION : repository is read-only

What it means

KettleFileRepositorySecurityProvider.validateAction() throws this KettleException when a MODIFY_TRANSFORMATION operation is requested but the repository capabilities say it is read-only. The file repository has no fine-grained security model; it only enforces the read-only flag.

Solutions

1. Reconnect to the repository with the read-only option disabled
2. Set readOnly=false (remove read_only=Y) on the KettleFileRepositoryMeta before connecting
3. Check capabilities via repo.getRepositoryCapabilities().isReadOnly() before attempting saves
4. If read-only is intentional, route writes to a writable repository

Example fix

// before
KettleFileRepositoryMeta meta = new KettleFileRepositoryMeta();
meta.setReadOnly(true); // any save will fail
// after
meta.setReadOnly(false); // or verify before saving
if (!repo.getRepositoryCapabilities().isReadOnly()) {
  repo.save(transMeta, "comment", null);
}

if (repo.getRepositoryCapabilities().isReadOnly()) {
  throw new IllegalStateException("Repository is read-only; cannot modify transformations");
}

try {
  repo.save(transMeta, "comment", null);
} catch (KettleException e) {
  if (e.getMessage().contains("read-only")) {
    log.error("Reconnect with a writable repository");
  }
}

When it happens

Trigger: Any save/update of a transformation (saveTransformation, etc.) through a KettleFileRepository whose RepositoryCapabilities.isReadOnly() is true - typically a repository meta opened with read_only=Y.

Common situations: Repository connection configured with read-only flag (or hides read-only default in Spoon); writing to a repository loaded programmatically with a read-only KettleFileRepositoryMeta.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• DELETE_TRANSFORMATION : repository is read-only
• MODIFY_JOB : repository is read-only
• AbsSecurityProvider.ERROR_0002_UNABLE_TO_ACCESS_IS_ALLOWED
• AbsSecurityProvider.ERROR_0003_UNABLE_TO_ACCESS_GET_ALLOWED_ACTIONS
• DELETE_DATABASE : repository is read-only

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/be31cf2f212e562b. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/repository/filerep/KettleFileRepositorySecurityProvider.java:53

  }

  public UserInfo getUserInfo() {
    return null;
  }

  public RepositoryMeta getRepositoryMeta() {
    return repositoryMeta;
  }

  public void validateAction( RepositoryOperation... operations ) throws KettleException, KettleSecurityException {

    for ( RepositoryOperation operation : operations ) {
      switch ( operation ) {
        case READ_TRANSFORMATION:
          break;
        case MODIFY_TRANSFORMATION:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case DELETE_TRANSFORMATION:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }
          break;
        case EXECUTE_TRANSFORMATION:
          break;
        case LOCK_TRANSFORMATION:
          break;

        case READ_JOB:
          break;
        case MODIFY_JOB:
          if ( capabilities.isReadOnly() ) {
            throw new KettleException( operation + " : repository is read-only" );
          }

View on GitHub (pinned to f3058517a1)