apache/beam · error · RuntimeException

Error matching values. Secret was discovered but its value i

Error message

Error matching values. Secret was discovered but its value is null

What it means

processSecret() writes the fetched secret bytes to the local keytab path with Files.write(). If writing throws IOException, a RuntimeException with this message is thrown. Notably the original IOException is NOT chained, so the underlying reason must be inferred from context/logs.

Source

Thrown at sdks/java/extensions/kafka-factories/src/main/java/org/apache/beam/sdk/extensions/kafka/factories/KerberosConsumerFactoryFn.java:113

              super.getBaseDirectory() + "/" + LOCAL_FACTORY_TYPE + "/" + "krb5.conf";
          localKrb5ConfPath = downloadExternalFile(this.krb5ConfigPath, localPath);

          System.setProperty("java.security.krb5.conf", localKrb5ConfPath);
          Configuration.getConfiguration().refresh();
        }
      }
    }
  }

  @Override
  protected String processSecret(String originalValue, String secretId, byte[] secretValue)
      throws RuntimeException {
    Matcher matcher = KEYTAB_SECRET_PATTERN.matcher(originalValue);
    String localFileString = "";
    while (matcher.find()) {
      String currentSecretId = matcher.group(1);
      if (currentSecretId == null || currentSecretId.isEmpty()) {
        throw new RuntimeException(
            "Error matching values. Secret was discovered but its value is null");
      }
      currentSecretId = currentSecretId.substring(KEYTAB_SECRET_PREFIX.length());
      if (!currentSecretId.equals(secretId)) {
        // A sasl.jaas.config can contain multiple keytabs in one string. Therefore, we must assume
        // that there can
        // also be multiple keytab secrets in the same string. If the currently matched secret does
        // not equal
        // the secret that we are processing (passed in via secretId) then we do not want to create
        // a keytab file and overwrite it.
        continue;
      }
      String filename = "kafka-client-" + UUID.randomUUID().toString() + ".keytab";

      localFileString = super.getBaseDirectory() + "/" + LOCAL_FACTORY_TYPE + "/" + filename;
      Path localFilePath = Paths.get(localFileString);
      Path parentDir = localFilePath.getParent();
      try {

View on GitHub (pinned to 12126d8942)

Solutions

Check worker logs around the failure for permission or missing-directory errors (cause is swallowed)
Ensure the local keytab directory exists and is writable by the worker process before the pipeline runs
Run the worker with a writable temp/staging volume
Retest by writing a dummy file to the same localFilePath in the worker image

Defensive patterns

Strategy: validation

Validate before calling

java
if (saslJaasConfig.matches(".*" + Pattern.quote(KEYTAB_SECRET_PREFIX) + "\\s*(\\s|\"|$).*")) {
  throw new IllegalArgumentException("sasl.jaas.config contains an empty keytab secret reference");
}

Try / catch

java
try {
  factoryFn.processSecret(config);
} catch (RuntimeException ex) {
  if (ex.getMessage().contains("Secret was discovered but its value is null")) {
    log.severe("Incomplete keytab secret reference in sasl.jaas.config");
  }
}

Prevention

Ensure template variables are substituted before config reaches the pipeline
Fail fast on empty template placeholders in CI config validation
Avoid literal occurrences of the secret prefix in unrelated values
Review hand-edited sasl.jaas.config for truncated references

When it happens

Trigger: Files.write fails on the resolved local path: parent directory doesn't exist, disk full, or the worker process lacks write permission on the target directory.

Common situations: Read-only container filesystem; staging directory wiped between secret fetch and write; path collisions/permission issues on the worker; large keytab exceeding temp space.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/e6abf3d1197360b2. Report an issue: GitHub.