apache/pulsar · error · IllegalArgumentException

Kubernetes Secret should contain id information

Error message

Kubernetes Secret should contain id information

What it means

In doAdmissionChecks, each Kubernetes secret entry must be a Map containing the reserved id key ('id') identifying the Kubernetes Secret name. When the entry is a Map of at least 2 entries but lacks the idKey field, this IllegalArgumentException is thrown.

Source

Thrown at pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java:132

    // The secret object should be of type Map<String, String> and it should contain "id" and "key"
    @Override
    public void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, String jobName,
                                  FunctionDetails functionDetails) {
        if (!StringUtils.isEmpty(functionDetails.getSecretsMap())) {
            Type type = new TypeToken<Map<String, Object>>() {
            }.getType();
            Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);

            for (Object object : secretsMap.values()) {
                if (object instanceof Map) {
                    @SuppressWarnings("unchecked") // secret values are expected to be Map<String, String>
                    Map<String, String> kubernetesSecret = (Map<String, String>) object;
                    if (kubernetesSecret.size() < 2) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain id and key");
                    }
                    if (!kubernetesSecret.containsKey(idKey)) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain id information");
                    }
                    if (!kubernetesSecret.containsKey(keyKey)) {
                        throw new IllegalArgumentException("Kubernetes Secret should contain key information");
                    }
                } else {
                    throw new IllegalArgumentException("Kubernetes Secret should be a Map containing id/key pairs");
                }
            }
        }
    }
}

View on GitHub (pinned to 820761864e)

Solutions

Rename/add the 'id' field in each secret entry to the Kubernetes Secret's name
Use exactly the shape {"id": "<kubernetes-secret-name>", "key": "<key-within-secret>"} for each exposed secret
Check the configurator's idKey constant to confirm the expected field name for your Pulsar version

Example fix

// before
secrets: {"mysecret": {"name": "db-creds", "key": "password"}}
// after
secrets: {"mysecret": {"id": "db-creds", "key": "password"}}

Defensive patterns

Strategy: validation

Validate before calling

void requireSecretId(Map<String, Object> secrets) {
    for (Map.Entry<String, Object> e : secrets.entrySet()) {
        Map<?, ?> m = (Map<?, ?>) e.getValue();
        if (!m.containsKey("id")) {
            throw new IllegalArgumentException("Secret '" + e.getKey() + "' missing 'id' (k8s secret name)");
        }
    }
}

Type guard

static boolean hasSecretId(Object v) {
    return v instanceof Map<?, ?> m && m.containsKey("id");
}

Try / catch

try {
    admin.functions().updateFunction(functionConfig);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("id information")) { /* add 'id' field to secret entries */ }
}

Prevention

Use the field name 'id' exactly — not name/path/secretName
Keep a shared JSON schema for your function configs and validate against it
Copy secret formats from official Pulsar K8s examples

When it happens

Trigger: doAdmissionChecks receives a secrets map entry like {"password": "...", "user": "..."} or {"key": "password"} — a Map whose keys do not include 'id' — instead of {"id": "<secret-name>", "key": "<key>"}.

Common situations: developers pass the raw secret contents (key/value pairs inside the secret) instead of the reference metadata; confusion with ClearSecretsProvider format which takes different fields; renaming id field to name/path/secretName.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/844c05cf055afd0c. Report an issue: GitHub.