prestodb/presto · error · ArrowException

ARROW_FLIGHT_CLIENT_ERROR

ARROW_FLIGHT_CLIENT_ERROR

Error message

Error creating flight client:

What it means

The fallback branch of createFlightClient: any exception during FlightClient construction that is neither InvalidKeyException nor CertificateException is wrapped as ArrowException(ARROW_FLIGHT_CLIENT_ERROR) with 'Error creating flight client: <msg>'. This covers transport-level construction failures such as unresolved host, bad target string, or unsupported channel options.

Source

Thrown at presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java:99

                flightClientBuilder.trustedCertificates(trustedCertificate.get()).useTls();
            }
            if (config.getFlightClientSSLCertificate() != null && config.getFlightClientSSLKey() != null) {
                clientCertificate = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLCertificate())));
                clientKey = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLKey())));
                flightClientBuilder.clientCertificate(clientCertificate.get(), clientKey.get()).useTls();
            }

            return flightClientBuilder.build();
        }
        catch (Exception e) {
            if (e.getCause() instanceof InvalidKeyException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_KEY_ERROR, "Error creating flight client, invalid key file: " + e.getMessage(), e);
            }
            else if (e.getCause() instanceof CertificateException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR, "Error creating flight client, invalid certificate file: " + e.getMessage(), e);
            }
            else {
                throw new ArrowException(ARROW_FLIGHT_CLIENT_ERROR, "Error creating flight client: " + e.getMessage(), e);
            }
        }
        finally {
            if (trustedCertificate.isPresent()) {
                try {
                    trustedCertificate.get().close();
                }
                catch (IOException e) {
                    logger.error("Error closing input stream for server certificate", e);
                }
            }
            if (clientCertificate.isPresent()) {
                try {
                    clientCertificate.get().close();
                }
                catch (IOException e) {
                    logger.error("Error closing input stream for client certificate", e);
                }

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Read the cause message for the transport failure (host, port, scheme).
  2. Fix host/port/scheme in catalog properties and verify DNS from each worker.
  3. Test connectivity: `nc -zv <host> <port>` to the Flight server.
  4. Confirm the required Flight client libraries are on the classpath (no version conflicts).
  5. If it's actually a TLS problem misclassified here, fix key/cert config per the specific errors.

Example fix

# before
arrow.flight.location=server.internal
# after
arrow.flight.location=grpc+tls://server.internal:32010
Defensive patterns

Strategy: try-catch

Validate before calling

// Check reachability before creating the client
String host = config.getHost(); int port = config.getPort();
try (java.net.Socket s = new java.net.Socket()) {
    s.connect(new java.net.InetSocketAddress(host, port), 3000); // throws if unreachable
}

Try / catch

try {
    FlightClient client = handler.createFlightClient();
} catch (ArrowException e) {
    if (e.getErrorCode().getCode() == ARROW_FLIGHT_CLIENT_ERROR.getCode()) {
        // inspect e.getCause(): fix host/port/scheme/DNS and retry
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling createFlightClient when building the gRPC/Arrow Flight channel fails for reasons other than TLS key/cert parsing: DNS resolution failure, invalid host/port config, missing Location/target scheme, or generic runtime errors in the builder.

Common situations: Wrong host/port or DNS name for the Flight server in catalog properties; server host unresolvable from Presto workers; missing 'grpc+tls'/'grpc+tcp' scheme in the location; network policy blocking egress; corrupted auth token configuration.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/4543ad3178159ba8. Report an issue: GitHub.