apache/pulsar · error · RuntimeException

Unable to initialize crypto config %s

Error message

Unable to initialize crypto config %s

What it means

ProducerBuilderFactory loads the user's crypto key reader class from the function classloader (initializeCrypto) based on the producer's cryptoConfig. If the configured class name cannot be found (ClassNotFoundException), the builder cannot construct the end-to-end encryption machinery and throws RuntimeException embedding the cryptoConfig string.

Source

Thrown at pulsar-functions/instance/src/main/java/org/apache/pulsar/functions/instance/ProducerBuilderFactory.java:62

 * and this class is used to unify the configuration of the producers without duplicating code.
 */
@CustomLog
public class ProducerBuilderFactory {

    private final PulsarClient client;
    private final ProducerConfig producerConfig;
    private final Consumer<ProducerBuilder<?>> defaultConfigurer;
    private final Crypto crypto;

    public ProducerBuilderFactory(PulsarClient client, ProducerConfig producerConfig, ClassLoader functionClassLoader,
                                  Consumer<ProducerBuilder<?>> defaultConfigurer) {
        this.client = client;
        this.producerConfig = producerConfig;
        this.defaultConfigurer = defaultConfigurer;
        try {
            this.crypto = initializeCrypto(functionClassLoader);
        } catch (ClassNotFoundException e) {
            throw new RuntimeException("Unable to initialize crypto config " + producerConfig.getCryptoConfig(), e);
        }
        if (crypto == null) {
            log.info("crypto key reader is not provided, not enabling end to end encryption");
        }
    }

    @SuppressWarnings("deprecation")
    public <T> ProducerBuilder<T> createProducerBuilder(String topic, Schema<T> schema, String producerName) {
        ProducerBuilder<T> builder = client.newProducer(schema);
        if (defaultConfigurer != null) {
            defaultConfigurer.accept(builder);
        }
        builder.blockIfQueueFull(true)
                .enableBatching(true)
                .batchingMaxPublishDelay(10, TimeUnit.MILLISECONDS)
                .hashingScheme(HashingScheme.Murmur3_32Hash) //
                .messageRoutingMode(MessageRoutingMode.CustomPartition)
                .messageRouter(FunctionResultRouter.of())

View on GitHub (pinned to 820761864e)

Solutions

1. Verify readerClassName matches a fully-qualified class that exists in the uploaded function JAR (unzip -l and check)
2. Add the crypto key reader implementation and its dependencies to the function JAR and redeploy
3. If encryption is not needed, remove the cryptoConfig from the producer config so the builder skips crypto (logged as 'crypto key reader is not provided')
4. Check shade plugin relocations — un-relocate the key reader package or update the configured class name

Example fix

// before
ProducerConfig cfg = ProducerConfig.newBuilder()
    .setCryptoConfig("{\"readerClassName\":\"com.acme.OldKeyReader\"}").build();
// after
ProducerConfig cfg = ProducerConfig.newBuilder()
    .setCryptoConfig("{\"readerClassName\":\"com.acme.BuiltinKeyReader\"}").build();

String readerClass = extractReaderClassName(producerConfig.getCryptoConfig());
Class.forName(readerClass, true, functionClassLoader); // fails fast if missing

try { new ProducerBuilderFactory(client, fn, pc, cc, cl); }
catch (RuntimeException e) {
  if (e.getMessage().startsWith("Unable to initialize crypto config")) {
    log.error("Check readerClassName exists in the function JAR", e.getCause());
  }
}

When it happens

Trigger: producerConfig.cryptoConfig.readerClassName names a class not present in the function JAR or its dependencies; typo in the class name; the crypto key reader class is shaded/relocated; crypto configured but the JAR with the key reader was not uploaded.

Common situations: Enabling end-to-end encryption on a sink/producer function whose key reader library isn't bundled; renaming the key reader class after an upgrade without updating function config; shade plugin relocating the crypto package; fat JAR missing optional crypto dependencies.

Related errors

• Config class not found: %s
• Error starting LogTopic Producer for function %s
• The crypto key reader class %s does not exist
• Failed to decode public key
• The ${alg.name()} algorithm does not support Key Pairs.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/1b63ffffd54b1425. Report an issue: GitHub.