prestodb/presto · critical · IllegalArgumentException

Could not read secret file " + secretFile

Error message

Could not read secret file " + secretFile

What it means

LarkSheetsUtil.loadAppSecret reads the configured secret file from disk, decodes it (codec.fromBytes) into a key/value map, and surfaces any read/decode failure as IllegalArgumentException('Could not read secret file <path>', e). This fires at connector initialization when the app credential cannot be loaded.

Source

Thrown at presto-lark-sheets/src/main/java/com/facebook/presto/lark/sheets/LarkSheetsUtil.java:49

public final class LarkSheetsUtil
{
    static final int RADIX = 26;
    private static final String[] ALPHABETS = buildAlphabetTable();
    private static final int MASK_REMAIN = 6;

    private LarkSheetsUtil() {}

    public static String loadAppSecret(String secretFile)
    {
        JsonCodec<Map<String, String>> codec = JsonCodec.mapJsonCodec(String.class, String.class);

        final Map<String, String> content;
        try {
            byte[] bytes = Files.readAllBytes(Paths.get(secretFile));
            content = codec.fromBytes(bytes);
        }
        catch (Exception e) {
            throw new IllegalArgumentException("Could not read secret file " + secretFile, e);
        }

        String secret = content.get("app-secret");
        if (emptyToNull(secret) == null) {
            throw new IllegalArgumentException("app-secret not provided in " + secretFile);
        }
        return secret;
    }

    public static String mask(String str)
    {
        if (str != null && str.length() > MASK_REMAIN) {
            char[] chars = str.toCharArray();
            Arrays.fill(chars, 0, chars.length - MASK_REMAIN, '*');
            return new String(chars);
        }
        return str;
    }

View on GitHub (pinned to 55bb57d202)

Solutions

  1. Verify the secret file path in the connector properties and correct it.
  2. Regenerate the secret file with the expected codec/format and redeploy.
  3. Fix file permissions so the Presto process user can read it.
  4. Check the file exists in the deployed environment (container volume mount, image includes it).

Example fix

# before
lark.sheets.secret-file=/etc/secrets/lark/secret.bin   # file missing
# after
lark.sheets.secret-file=/etc/secrets/lark/app-secret.properties  # correct, existing path
Defensive patterns

Strategy: validation

Validate before calling

Path p = Paths.get(secretFile);
if (!Files.isRegularFile(p)) throw new IllegalStateException("Secret file missing: " + p);
if (!Files.isReadable(p)) throw new IllegalStateException("Secret file not readable: " + p);
// plus verify decodability with the same codec before startup

Try / catch

try {
    Properties props = LarkSheetsPropertiesUtil.load(config);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Could not read secret file")) {
        // check path, mount, permissions, file format
    } else { throw e; }
}

Prevention

When it happens

Trigger: Files.readAllBytes throws (file missing, path wrong, no read permission) or codec.fromBytes throws (corrupt/invalid encoding) when loadAppSecret parses the configured secretFile path.

Common situations: Typo in the properties file path (lark.sheets secret-file config); file not mounted in a container; wrong file format produced by an incompatible secret-generation tool; read permissions after deployment user change.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/b1e77e3572b333f6. Report an issue: GitHub.