Luiz Berger
10/28/2025, 12:45 PMi.a.a.c.a.DataplaneAccessTokenInterceptor(intercept):151 - Failed to obtain or add dataplane access token
java.lang.Exception: Token request failed with HTTP code 500
It seems that this data plane thing is just required for self-managed enterprise, not for community version. What should we do?kapa.ai
10/28/2025, 12:46 PMdataplane-client-id and dataplane-client-secret were not being properly created or managed in the airbyte-auth-secrets Kubernetes secret. Here's what you should do: 1. Upgrade to version 1.6.1 or later - The [release notes for version 1.6](https://docs.airbyte.com/release_notes/v-1.6#patches) confirm that version 1.6.1 fixed issue #58587, which caused some 1.6.0 installs and upgrades using abctl and helm to fail. Since you're upgrading to 1.6.9, this should already include the fix. 2. If you're still experiencing issues, try this workaround that worked for other users: - Connect to your Airbyte database - Run these SQL commands: sql delete from dataplane_client_credentials; delete from dataplane; - Then reinstall or restart your Airbyte deployment 3. Important note: The [documentation on service account updates](https://docs.airbyte.com/platform/enterprise-setup/upgrade-service-account) states: "If you're a Self-Managed Community user, this information isn't relevant to you." This confirms that the dataplane authentication requirements are primarily for Self-Managed Enterprise customers, not Community users. However, the dataplane functionality was still introduced in the Community version in 1.6.0, which is why you're encountering these issues. The fix in 1.6.1 should handle the dataplane credentials automatically for Community users without requiring manual configuration. If the issue persists after upgrading to 1.6.9, you may want to consider the database cleanup workaround mentioned above to reset the dataplane configuration.Luiz Berger
10/28/2025, 1:07 PMairbyte=> delete from dataplane_client_credentials;
DELETE 2
airbyte=> delete from dataplane;
DELETE 1
errors persist @kapa.ai 😞kapa.ai
10/28/2025, 1:09 PMkapa.ai
10/28/2025, 1:09 PMdataplane_group entries were created, causing jobs to be pushed to one dataplane while the workload launcher was listening to another. Here's what you should check: 1. Verify your dataplane_group configuration: sql SELECT * FROM public.dataplane_group; Check if you have multiple dataplane_group entries. 2. Check your workspace configuration: sql SELECT id, organization_id, dataplane_group_id FROM public.workspace; Ensure the dataplane_group_id in your workspace table matches the correct dataplane_group that your workload launcher is using. 3. If there's a mismatch, you may need to update the workspace to point to the correct dataplane_group_id. Additional troubleshooting steps: Since you've already deleted the dataplane records and the errors persist, the issue might be that: - The bootloader hasn't recreated the dataplane credentials properly - The secrets in Kubernetes haven't been updated Try these steps: 1. After deleting the database records, restart the bootloader pod to force it to recreate the dataplane configuration 2. Verify that the airbyte-auth-secrets Kubernetes secret now contains the dataplane-client-id and dataplane-client-secret keys: bash kubectl get secret airbyte-auth-secrets -n <your-namespace> -o yaml If the secrets are still missing after the bootloader runs, there may be a deeper issue with the bootloader's dataplane initialization process in your specific deployment configuration.Luiz Berger
10/28/2025, 1:59 PMdataplane_group_id
the id and secret are the same as the ones for instance-admin-client
the bootloader pod was executed again, but the error persist.kapa.ai
10/28/2025, 1:59 PMkapa.ai
10/28/2025, 1:59 PMLuiz Berger
10/28/2025, 2:20 PMkapa.ai
10/28/2025, 2:20 PMkapa.ai
10/28/2025, 2:20 PMLuiz Berger
10/29/2025, 1:39 PMkapa.ai
10/29/2025, 1:39 PMkapa.ai
10/29/2025, 1:40 PMLuiz Berger
11/01/2025, 1:26 AM/api/v1/dataplanes/tokenkapa.ai
11/01/2025, 1:26 AMkapa.ai
11/01/2025, 1:26 AM/api/v1/dataplanes/token endpoint as part of the dataplane authentication mechanism that was introduced in Airbyte version 1.6.0, and this applies to both Community and Enterprise editions. According to the [GitHub issue #58587](https://github.com/airbytehq/airbyte/issues/58587), the error logs show: Failed to obtain or add dataplane access token java.lang.Exception: Token request failed with HTTP code 500 at io.airbyte.api.client.auth.DataplaneAccessTokenInterceptor.fetchNewToken(DataplaneAccessTokenInterceptor.kt:110) This indicates that the DataplaneAccessTokenInterceptor is trying to fetch a token, which is part of the dataplane authentication system introduced in version 1.6.0. Why this happens in Community Edition: While the [documentation on service account updates](https://docs.airbyte.com/platform/enterprise-setup/upgrade-service-account) states that "If you're a Self-Managed Community user, this information isn't relevant to you," the dataplane architecture itself was introduced in version 1.6.0 for all editions as part of the [Workloads feature](https://docs.airbyte.com/release_notes/july_2024). The [July 2024 release notes](https://docs.airbyte.com/release_notes/july_2024) explain: > "Workloads have been released with Airbyte Helm Chart 0.390.0, which provides a more scalable and reliable architecture to run sync jobs by separating scheduling and orchestration from data movement tasks." This workloads architecture requires dataplane authentication for internal communication between Airbyte components, regardless of whether you're using Community or Enterprise edition. The workload-launcher needs to authenticate with the dataplane to manage and execute sync jobs. The token generation is necessary because: 1. The workload-launcher needs to authenticate with the dataplane API to manage workloads 2. This authentication uses the dataplane-client-id and dataplane-client-secret stored in the airbyte-auth-secrets Kubernetes secret 3. The token endpoint (/api/v1/dataplanes/token) is used to exchange these credentials for an access token This is an internal authentication mechanism between Airbyte components, not related to user authentication or Enterprise-specific features. It's part of the core workloads architecture that was introduced in version 1.6.0 for all editions.Luiz Berger
11/03/2025, 5:35 PMInternal Server Error: Service account not found, even though I can find the service account and dataplane created in the database.kapa.ai
11/03/2025, 5:35 PMkapa.ai
11/03/2025, 5:35 PMworkspace_service_account table structure: According to the [database catalog documentation](https://docs.airbyte.com/platform/understanding-airbyte/database-data-catalog#workspace_service_account), the workspace_service_account table has the following structure: - Primary Key: (workspace_id, service_account_id) - Foreign Key: workspace_id references workspace(id) This means that service accounts are workspace-specific, not global. When the token endpoint tries to authenticate, it's likely looking for a service account associated with a specific workspace. What to check: 1. Verify the workspace association: sql SELECT * FROM workspace_service_account; Check if there's a record that links your service account to a workspace. 2. Check if the workspace exists: sql SELECT id FROM workspace; Ensure the workspace referenced in workspace_service_account actually exists. 3. Verify the dataplane configuration: sql SELECT * FROM dataplane; SELECT * FROM dataplane_client_credentials; Confirm that the dataplane records exist and are properly configured. Possible causes: 1. Missing workspace association - The service account exists in the database, but there's no entry in the workspace_service_account table linking it to a workspace. 2. Orphaned service account - The service account references a workspace that no longer exists (foreign key constraint issue). 3. Incorrect credentials format - The json_credential or hmac_key fields in the workspace_service_account table might be malformed or empty. Recommended action: Since you mentioned that you can see the service account and dataplane in the database, check specifically: sql SELECT ws.workspace_id, ws.service_account_id, ws.service_account_email, w.id as workspace_exists FROM workspace_service_account ws LEFT JOIN workspace w ON ws.workspace_id = w.id; If the workspace_exists column is NULL, it means the service account is referencing a non-existent workspace, which would cause the "Service account not found" error. If this is the case, you may need to either: - Recreate the workspace-service account association - Let the bootloader reinitialize the entire dataplane configuration by deleting all related records and restarting Unfortunately, the knowledge sources don't provide specific details about how to manually fix this association, so you may need to allow the bootloader to recreate the entire configuration from scratch.Luiz Berger
11/03/2025, 5:55 PMworkspace_service_account table linking it to a workspace.
this table is empty for me.kapa.ai
11/03/2025, 5:55 PMkapa.ai
11/03/2025, 5:56 PMworkspace_service_account table is the root cause of your "Service account not found" error. This table is critical for the dataplane authentication to work properly. Why this is causing your issue: According to the [database catalog documentation](https://docs.airbyte.com/platform/understanding-airbyte/database-data-catalog#workspace_service_account), the workspace_service_account table stores the association between workspaces and their service accounts, including the credentials needed for authentication. When the token endpoint tries to authenticate, it looks for a service account associated with a workspace in this table. Since your table is empty, the authentication fails with "Service account not found." What should happen during initialization: The bootloader should populate this table during the dataplane initialization process. The fact that it's empty suggests that either: 1. The bootloader hasn't completed the dataplane initialization successfully 2. There's an issue preventing the bootloader from creating the workspace-service account association Recommended steps: 1. Check your workspace table: sql SELECT id, name, dataplane_group_id FROM workspace; Verify that you have at least one workspace and that it has a dataplane_group_id assigned. 2. Check your dataplane_group table: sql SELECT * FROM dataplane_group; Ensure there's a dataplane_group record that matches the dataplane_group_id in your workspace. 3. Force a complete reinitialization: Since the workspace_service_account table is empty, you should delete all dataplane-related records and let the bootloader recreate everything: sql DELETE FROM workspace_service_account; DELETE FROM dataplane_client_credentials; DELETE FROM dataplane; Then restart the bootloader pod to trigger a fresh initialization. 4. Check bootloader logs: After restarting the bootloader, check its logs for any errors during the dataplane initialization process. Look specifically for errors related to creating service accounts or workspace associations. The empty workspace_service_account table indicates that the dataplane initialization process hasn't completed successfully, which is why your token endpoint requests are failing. The bootloader should populate this table automatically during initialization, so if it remains empty after a restart, there's likely an underlying issue preventing the bootloader from completing the setup process.Luiz Berger
11/03/2025, 5:59 PM2025-11-03 17:28:00,549 [main] [34mINFO[0;39m i.a.b.Bootloader(load):97 - Creating workspace (if none exists)...
2025-11-03 17:28:00,633 [main] [34mINFO[0;39m i.a.b.Bootloader(createWorkspaceIfNoneExists):196 - Workspace already exists for the deployment.kapa.ai
11/03/2025, 5:59 PMkapa.ai
11/03/2025, 6:00 PMCreating workspace (if none exists)... Workspace already exists for the deployment. This indicates that the bootloader found an existing workspace in the database and didn't attempt to create a new one. However, the bootloader should still initialize the dataplane and service account associations even when a workspace already exists. The problem: Since your workspace_service_account table is empty, it suggests that: 1. The workspace was created before the dataplane functionality was introduced (likely in version 1.5.1 or earlier) 2. The bootloader is not creating the service account association for existing workspaces during the upgrade to 1.6.9 What to look for in the logs: You should see additional log entries after the workspace check that indicate dataplane initialization. Look for logs related to: - Dataplane creation - Service account creation - Credential generation If these logs are missing, it means the bootloader is not completing the full dataplane initialization process. Recommended action: Since the bootloader is detecting an existing workspace but not creating the service account association, you may need to: 1. Check if there are any errors after the workspace check - Look for any ERROR or WARN messages in the bootloader logs that occur after the "Workspace already exists" message. 2. Verify your workspace has a dataplane_group_id: sql SELECT id, name, dataplane_group_id FROM workspace; If the dataplane_group_id is NULL, this could prevent the service account association from being created. 3. Consider a clean dataplane initialization - Since you have an existing workspace from a pre-1.6 version, the upgrade process might not be handling the dataplane initialization correctly. You may need to manually ensure the workspace has a proper dataplane_group_id before the bootloader can create the service account association. Unfortunately, the knowledge sources don't provide specific information about how the bootloader handles dataplane initialization for existing workspaces during upgrades. The logs you've shared suggest the bootloader is stopping after detecting the existing workspace, without completing the full dataplane setup that's required in version 1.6.9.Luiz Berger
11/03/2025, 6:18 PMkapa.ai
11/03/2025, 6:18 PMkapa.ai
11/03/2025, 6:18 PMworkspace_service_account association is created in the Bootloader.kt file. What I can suggest: If you want to understand the exact code flow, you would need to: 1. Review the Bootloader.kt file directly on GitHub at the link you provided 2. Look for methods related to dataplane initialization, service account creation, or workspace-service account associations 3. Check if there are any conditional statements that might skip the association creation for existing workspaces I'm sorry I cannot provide more specific information about the code structure without access to the actual source file in my knowledge sources.Luiz Berger
11/03/2025, 6:45 PMkapa.ai
11/03/2025, 6:45 PMkapa.ai
11/03/2025, 6:46 PMworkspace_service_account table and the Community edition. The workspace_service_account table is documented for all editions: The [database catalog documentation](https://docs.airbyte.com/platform/understanding-airbyte/database-data-catalog#workspace_service_account) describes the workspace_service_account table structure for versions 1.6, 1.7, 1.8, and next, without any indication that it's Enterprise-only. This suggests the table should exist and be populated in the Community edition as well. However, there's a critical issue with version 1.6.x: According to [GitHub issue #64159](https://github.com/airbytehq/airbyte/issues/64159), there was a known problem with how the bootloader handled dataplane initialization in versions prior to 1.8.0: > "While deploying the 1.7.2 version of Helm chart and defining the dataplane-client-id and dataplane-client-secret by itself at the airbyte-auth secret, it always re-generates the dataplane-client-id and dataplane-client-secret by the bootloader." A contributor confirmed that the behavior was fixed in version 1.8.0: > "The new behavior will look for valid credentials in the secret first, and if valid credentials exist, it will skip the rest of the dataplane initialization. That should be available in release 1.8.0" The root problem: The knowledge sources show that version 1.6.x (including 1.6.9) had significant issues with dataplane initialization, as evidenced by [GitHub issue #58587](https://github.com/airbytehq/airbyte/issues/58587), where multiple users reported problems with dataplane credentials not being created properly, even after following workarounds. My assessment: The knowledge sources do not explicitly state whether the workspace_service_account table should be populated in the Community edition for version 1.6.9. However, the fact that: 1. The dataplane architecture was introduced in version 1.6.0 for all editions 2. Multiple users reported similar dataplane issues in version 1.6.x 3. The fixes were only implemented in version 1.8.0 This strongly suggests that version 1.6.9 has incomplete or buggy dataplane initialization, which is why your workspace_service_account table remains empty despite your efforts. Recommendation: Based on all the evidence in the knowledge sources, you should upgrade to version 1.8.x as I recommended earlier. The knowledge sources consistently show that version 1.6.x had significant dataplane initialization issues that were only resolved in version 1.8.0 and later.Luiz Berger
11/03/2025, 6:48 PMkapa.ai
11/03/2025, 6:48 PMkapa.ai
11/03/2025, 6:49 PMworkspace_service_account table is still empty or if you're still experiencing the same issues. What you should check now: 1. Verify if the workspace_service_account table is now populated: sql SELECT * FROM workspace_service_account; 2. Check the bootloader logs for version 1.8.5 - Look for any errors or warnings during the dataplane initialization process. The logs should show more than just the workspace check. 3. Verify the dataplane and credentials tables: sql SELECT * FROM dataplane; SELECT * FROM dataplane_client_credentials; 4. Check if the Kubernetes secret contains the dataplane credentials: bash kubectl get secret airbyte-auth-secrets -n <your-namespace> -o yaml Look for dataplane-client-id and dataplane-client-secret keys. Important note about version 1.8.5: According to the [1.8 release notes](https://docs.airbyte.com/release_notes/v-1.8#fixes), version 1.8 specifically "Fixed an issue that caused database migrations to fail when there was a single data plane group named 'AUTO'." This fix is directly related to the dataplane issues you've been experiencing. Additionally, the [1.8 patch releases](https://docs.airbyte.com/release_notes/v-1.8#patch-releases) show that version 1.8.1 "addresses an issue with data plane name constraints that prevented successful abctl uninstall/reinstall operations." If the issue persists in 1.8.5: Please share: - Whether the workspace_service_account table is still empty - The complete bootloader logs from version 1.8.5 - Any error messages you're seeing - Whether you're still getting the "Service account not found" error This information will help determine if there's a different issue at play or if the upgrade to 1.8.5 has resolved your problems.Luiz Berger
11/03/2025, 7:44 PMkapa.ai
11/03/2025, 7:44 PMkapa.ai
11/03/2025, 7:44 PMworkspace_service_account table remains empty even in a fresh install of version 1.8.5 is concerning and suggests there may be a deeper issue with your deployment configuration. Based on the knowledge sources, here's what should be happening: According to [GitHub issue #64159](https://github.com/airbytehq/airbyte/issues/64159), version 1.8.0 introduced a fix where: > "The new behavior will look for valid credentials in the secret first, and if valid credentials exist, it will skip the rest of the dataplane initialization." This means that in version 1.8.5, if you have any existing credentials in the airbyte-auth-secrets Kubernetes secret, the bootloader might skip creating new dataplane credentials and the workspace-service account association. Critical questions to investigate: 1. Are you using a custom airbyte-auth-secrets secret? Based on your earlier conversation, you mentioned: yaml auth: enabled: true instanceAdmin: secretName: "airbyte-auth-secrets" emailSecretKey: "instance-admin-email" passwordSecretKey: "instance-admin-password" If you're providing your own airbyte-auth-secrets secret with only instance-admin-email and instance-admin-password, the bootloader might be detecting this as "existing credentials" and skipping the dataplane initialization. 2. Check what's in your airbyte-auth-secrets before the bootloader runs: bash kubectl get secret airbyte-auth-secrets -n <your-namespace> -o yaml The likely issue: According to [GitHub issue #58587](https://github.com/airbytehq/airbyte/issues/58587), a user reported: > "The secret airbyte-auth-secrets is one created by me to store the instance admin email and password... Clearly, something after the installation changes and expects those credentials in some secret, but they are not." Another user in the same issue confirmed: > "I use airbyte-1.6.2 OSS community on k8s installed using helm. I have a custom airbyte-auth-secrets definition to be able to control the email and password. I also face the same error of dataplane-client-id not being found in the workload-launcher pod init events." The solution: If you're using a custom airbyte-auth-secrets secret, you need to either: 1. Let Airbyte manage the entire secret - Don't pre-create the airbyte-auth-secrets secret. Let the bootloader create it with all necessary keys, including the dataplane credentials. 2. Use a different secret name for your instance admin credentials - Unfortunately, the knowledge sources indicate that as of version 1.6.x, there wasn't a way to specify a separate secret for instance admin credentials. A user in [GitHub issue #58587](https://github.com/airbytehq/airbyte/issues/58587) requested: > "A great solution would be to be able to provide a different secret name for the custom set password so it doesn't interfere with airbyte managed airbyte-auth-secrets data keys at all." Recommendation: For a fresh install of version 1.8.5: 1. Do not pre-create the airbyte-auth-secrets secret 2. Remove the custom auth.instanceAdmin.secretName configuration from your values.yaml 3. Let the bootloader create the secret with all necessary credentials 4. After installation, you can retrieve the generated admin password using the appropriate command for your deployment method If you must use a custom admin password, you may need to wait for a version that supports separate secrets for admin credentials and dataplane credentials, or manually merge the credentials after the bootloader creates the secret (though this is not officially supported and may cause issues).Luiz Berger
11/03/2025, 7:54 PMkapa.ai
11/03/2025, 7:54 PMkapa.ai
11/03/2025, 7:54 PMairbyte-auth-secrets secret, the bootloader will automatically generate the necessary credentials, including the instance admin email and password. However, the knowledge sources provide specific guidance on how to set these values. For the instance admin email and password: According to the [authentication documentation](https://docs.airbyte.com/platform/1.8/deploying-airbyte/integrations/authentication#setting-a-password-via-secrets), you can control the default password by creating a Kubernetes secret: yaml apiVersion: v1 kind: Secret metadata: name: airbyte-auth-secrets type: Opaque stringData: instance-admin-password: # password # Override these if you want to access the API with known credentials #instance-admin-client-id: # my-client-id #instance-admin-client-secret: # my-client-secret Important note: The documentation states: "You may need to restart the airbyte-server pod for the changes to take effect." For Enterprise deployments: The [Enterprise implementation guide](https://docs.airbyte.com/platform/1.8/enterprise-setup/implementation-guide#creating-a-kubernetes-secret) shows that for Enterprise installations, you should include the instance admin email in the airbyte-config-secrets secret: yaml apiVersion: v1 kind: Secret metadata: name: airbyte-config-secrets type: Opaque stringData: # Instance Admin instance-admin-email: ## e.g. [email protected] instance-admin-password: ## e.g. password Regarding the JWT signature secret: The knowledge sources do not explicitly document how to configure the JWT signature secret separately. However, [GitHub issue #58587](https://github.com/airbytehq/airbyte/issues/58587) mentions that a user had to "merge" instance-admin-password and jwt-signature-secret into the airbyte-auth-secrets secret, suggesting that the JWT signature secret is also managed within the same secret. Recommendation: If you need to set a custom instance admin email and password: 1. Create the airbyte-auth-secrets secret with only the instance-admin-password (and optionally instance-admin-email if you're using Enterprise) 2. Let the bootloader generate the other required credentials (dataplane credentials, JWT signature, etc.) 3. Apply the secret before deploying Airbyte The bootloader should detect the existing password and use it while generating the other necessary credentials that are missing from the secret.Luiz Berger
11/03/2025, 8:21 PMkapa.ai
11/03/2025, 8:21 PMkapa.ai
11/03/2025, 8:22 PM