apache/pulsar · error · IllegalArgumentException

Kubernetes Secret should contain id and key

Error message

Kubernetes Secret should contain id and key

What it means

During function admission (doAdmissionChecks) each exposed secret must be a Map describing a Kubernetes secret with both an 'id' (secret name) and 'key' (key within the secret). If a secret entry's Map has fewer than 2 entries, the check throws this IllegalArgumentException because neither a valid id/key pair nor a well-formed secret reference can be present.

Source

Thrown at pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java:129

        return new TypeToken<Map<String, String>>() {
        }.getType();
    }

    // The secret object should be of type Map<String, String> and it should contain "id" and "key"
    @Override
    public void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, String jobName,
                                  FunctionDetails functionDetails) {
        if (!StringUtils.isEmpty(functionDetails.getSecretsMap())) {
            Type type = new TypeToken<Map<String, Object>>() {
            }.getType();
            Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);

            for (Object object : secretsMap.values()) {
                if (object instanceof Map) {
                    @SuppressWarnings("unchecked") // secret values are expected to be Map<String, String>
                    Map<String, String> kubernetesSecret = (Map<String, String>) object;
                    if (kubernetesSecret.size() < 2) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain id and key");
                    }
                    if (!kubernetesSecret.containsKey(idKey)) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain id information");
                    }
                    if (!kubernetesSecret.containsKey(keyKey)) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain key information");
                    }
                } else {
                    throw new IllegalArgumentException("Kubernetes Secret should be a Map containing id/key pairs");
                }
            }
        }
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Provide both required keys in each secret entry: {"<secretId>": {"id": "<k8s-secret-name>", "key": "<key-inside-secret>"}}
2. Check which entry has size < 2 in your secrets map and add the missing id or key field
3. Validate the secrets map locally before submitting (see validationCode in defense)

Example fix

// before
secrets: {"mysecret": {"id": "db-creds"}}
// after
secrets: {"mysecret": {"id": "db-creds", "key": "password"}}

void validateK8sSecrets(Map<String, Object> secrets) {
    for (Map.Entry<String, Object> e : secrets.entrySet()) {
        if (!(e.getValue() instanceof Map) || ((Map<?, ?>) e.getValue()).size() < 2) {
            throw new IllegalArgumentException("Secret '" + e.getKey() + "' must have both id and key");
        }
    }
}

static boolean isK8sSecretRef(Object v) {
    return v instanceof Map<?, ?> m && m.size() >= 2 && m.containsKey("id") && m.containsKey("key");
}

try {
    admin.functions().createFunction(functionConfig);
} catch (IllegalArgumentException e) {
    // inspect e.getMessage(); fix secrets map entries to contain id+key
}

When it happens

Trigger: Calling doAdmissionChecks (via function submission/validation, e.g. testConfigValidation) with a function config whose secrets map contains an entry whose value is a Map<String,String> with 0 or 1 entries — e.g. {"secretName": {"path": "mysecret"}} with only one key.

Common situations: users writing exposed secrets config from memory and providing only the secret path but not the key (or vice versa); copy-paste from non-Kubernetes examples where secrets are single strings; JSON/YAML edit dropping one of the two fields.

Related errors

• Kubernetes Secret should contain id information
• Kubernetes Secret should contain key information
• Kubernetes job name size should be less than %s
• KubernetesSecretsProviderConfigurator should only be setup f
• Kubernetes Secret should be a Map containing id/key pairs

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/950d509cf0d3601c. Report an issue: GitHub.