apache/beam · error · ValueError

Secret name must be specified in secret spec.

Error message

Secret name must be specified in secret spec.

What it means

GcpSecret._parse_version_name needs a secret identifier to build the resource path. If the spec has no 'version_name' and the 'name' key is absent or empty, it cannot form a secret ID and raises this ValueError.

Solutions

1. Add 'name': '<secret-id>' to the spec dict.
2. Or supply 'version_name': 'projects/<proj>/secrets/<id>/versions/<ver>' to bypass name/project parsing.
3. Validate the spec dict is non-empty and has a truthy 'name' before calling from_dict.

Example fix

// before
GcpSecret.from_dict({'project': 'my-proj'})
// after
GcpSecret.from_dict({'project': 'my-proj', 'name': 'db-pass'})

if 'version_name' not in spec and not spec.get('name'):
    raise ValueError('GcpSecret spec needs name or version_name')

def has_secret_identity(d) -> bool:
    return isinstance(d, dict) and (bool(d.get('version_name')) or bool(d.get('name')))

try:
    secret = GcpSecret.from_dict(spec)
except ValueError as e:
    raise ConfigError('secret spec missing name') from e

When it happens

Trigger: GcpSecret.from_dict({'project': 'my-proj'}) or from_dict({'name': ''}) — no 'version_name', and 'name' missing/empty/None.

Common situations: Building the secret spec programmatically where the name variable was empty; YAML/JSON config where the name field was omitted; relying on defaults that never set 'name'.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Missing required parameter(s) for GcpHsmGeneratedSecret
• Both a BigQuery table and a query were specified. Please…
• Both deidentification_template_name and…
• cache_root GCS bucket path is invalid.
• Cannot create a temporary directory for root path prefix

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/cbb7a8b8f407aa24. Report an issue: GitHub.

Appendix: source

Thrown at sdks/python/apache_beam/utils/secret.py:231

  @classmethod
  def from_dict(cls, spec_dict: Dict[str, str]) -> 'GcpSecret':
    """Initialize GcpSecret from a dictionary specification."""
    allowed_keys = {'version_name', 'name', 'project', 'version'}
    invalid_keys = set(spec_dict.keys()) - allowed_keys
    if invalid_keys:
      raise ValueError(
          f"Invalid secret parameter {', '.join(sorted(invalid_keys))}")
    version_name = cls._parse_version_name(spec_dict)
    return cls(version_name)

  @classmethod
  def _parse_version_name(cls, spec_dict: Dict[str, str]) -> str:
    if "version_name" in spec_dict:
      return spec_dict["version_name"]

    secret_id = spec_dict.get("name")
    if not secret_id:
      raise ValueError("Secret name must be specified in secret spec.")

    # Resolve project ID from spec, environment variables, or Application Default Credentials
    project_id = (
        spec_dict.get("project") or os.environ.get("GOOGLE_CLOUD_PROJECT") or
        os.environ.get("GCP_PROJECT"))

    if not project_id:
      try:
        import google.auth
        _, project_id = google.auth.default()
      except Exception:
        pass

    version_id = spec_dict.get("version", "latest")

    if not project_id:
      raise ValueError(
          f"Could not resolve GCP project ID for secret '{secret_id}'. "

View on GitHub (pinned to 12126d8942)