apache/pulsar · error · RuntimeException

Failed to create authentication secret for function %s/%s/%s

Error message

Failed to create authentication secret for function %s/%s/%s

What it means

createSecret (called from cacheAuthData) creates a new Kubernetes secret holding the function's auth token/data via a kubernetes-client action list, waiting on a success AtomicBoolean. If creation doesn't succeed it throws RuntimeException 'Failed to create authentication secret for function <tenant>/<namespace>/<name>'.

Source

Thrown at pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesSecretsTokenAuthProvider.java:404

                                .success(false)
                                .errorMsg(errorMsg)
                                .build();
                    }

                    sb.append(id.toCharArray());
                    return Actions.ActionResult.builder().success(true).build();
                })
                .build();

        AtomicBoolean success = new AtomicBoolean(false);
        Actions.newBuilder()
                .addAction(createAuthSecret.toBuilder()
                        .onSuccess(ignore -> success.set(true))
                        .build())
                .run();

        if (!success.get()) {
            throw new RuntimeException(
                    String.format("Failed to create authentication secret for function %s/%s/%s", tenant, namespace,
                            name));
        }

        return sb.toString();
    }

    private String getSecretName(String id) {
        return "pf-secret-" + id;
    }
}

View on GitHub (pinned to 820761864e)

Solutions

Ensure RBAC allows the worker service account to create secrets in the namespace
Verify the tenant/namespace Kubernetes namespace exists before deploying the function
Check secret payload size (etcd ~1MB limit) and shrink auth data if needed
Inspect kubectl events/logs for the root API error and retry after fixing

Example fix

// before
# namespace missing
// after
kubectl create namespace <tenant-ns>
kubectl create role secret-creator --verb=create,get --resource=secrets -n <tenant-ns>
kubectl create rolebinding fn-worker-secret-creator --role=secret-creator \
  --serviceaccount=<tenant-ns>:function-worker -n <tenant-ns>

Defensive patterns

Strategy: retry

Validate before calling

// preflight before deploying
// kubectl auth can-i create secrets --as=system:serviceaccount:<ns>:function-worker -n <ns>
// kubectl get namespace <ns>

Try / catch

try {
    provider.cacheAuthData(funcDetails, cache);
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Failed to create authentication secret")) {
        // ensure namespace exists and RBAC allows create; retry
    }
}

Prevention

Create the target k8s namespace before deploying functions
Ensure secret-create RBAC for the worker SA
Validate auth payload size and API connectivity before caching

When it happens

Trigger: Kubernetes API create failure during cacheAuthData: RBAC denied, namespace doesn't exist, secret already exists in a conflicting state, connection failure, or payload too large.

Common situations: Function worker without 'create' permission on secrets; deploying functions into a namespace that doesn't exist; oversized token/auth data; network policy blocking API access from workers.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/df685f2c7efc9931. Report an issue: GitHub.