{"record":{"id":"1ed9d4fba507e4b3","repo":"apache/beam","slug":"failed-to-get-secret","errorCode":null,"errorMessage":"Failed to get secret.","messagePattern":"Failed to get secret\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/kafka-factories/src/main/java/org/apache/beam/sdk/extensions/kafka/factories/FileAwareFactoryFn.java","lineNumber":140,"sourceCode":"\n              if (externalPath != null) {\n                try {\n                  String tmpPath = replacePathWithLocal(externalPath);\n                  String localPath = downloadExternalFile(externalPath, tmpPath);\n                  matcher.appendReplacement(sb, Matcher.quoteReplacement(localPath));\n                  LOG.info(\"Downloaded {} to {}\", externalPath, localPath);\n                } catch (IOException io) {\n                  throw new IOException(\"Failed to download file : \" + externalPath, io);\n                }\n              } else if (secretValue != null) {\n                try {\n                  String secretId = secretValue.substring(SECRET_VALUE_PREFIX.length());\n                  String processedSecret =\n                      processSecret(originalValue, secretId, getSecretWithCache(secretId));\n\n                  matcher.appendReplacement(sb, Matcher.quoteReplacement(processedSecret));\n                } catch (IllegalArgumentException ia) {\n                  throw new IllegalArgumentException(\"Failed to get secret.\", ia);\n                }\n              } else if (secretFile != null) {\n                throw new UnsupportedOperationException(\"Not yet implemented.\");\n              }\n            }\n            matcher.appendTail(sb);\n            String processedValue = sb.toString();\n            processedConfig.put(key, processedValue);\n          }\n        } catch (IOException ex) {\n          throw new RuntimeException(\"Failed trying to process value for key \" + key + \".\", ex);\n        }\n      }\n    } catch (IOException e) {\n      throw new RuntimeException(\"Failed trying to process extra files.\", e);\n    }\n\n    return createObject(processedConfig);","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/kafka-factories/src/main/java/org/apache/beam/sdk/extensions/kafka/factories/FileAwareFactoryFn.java#L122-L158","documentation":"FileAwareFactoryFn resolves secret placeholders in Kafka config values via a secrets manager. If secret processing throws IllegalArgumentException (e.g. malformed secret id, secret lookup rejected), it is rethrown as 'Failed to get secret.' with the cause attached.","triggerScenarios":"A config value contains a secret placeholder whose id is malformed or not resolvable at apply() time, causing getSecretWithCache/processSecret to throw IllegalArgumentException.","commonSituations":"Secret not created or deleted in the secrets manager, wrong secret id format in config, job lacks IAM permission to read the secret so the lookup fails.","solutions":["Verify the secret exists and its id in the config matches the expected format","Grant the job's service account permission to read the secret","Inspect the wrapped IllegalArgumentException cause for the precise failure"],"exampleFix":"// before\n\"password\": \"{{secret:db-pass}\" // malformed id\n// after\n\"password\": \"{{secret:projects/p/secrets/db-pass}}\" // correct format","handlingStrategy":"validation","validationCode":"if (secretId == null || secretId.isEmpty()) { throw new IllegalArgumentException(\"Empty secret id in config value\"); } // plus verify the secret exists via the secrets manager API before submit","typeGuard":"boolean looksLikeSecretRef(String v) { return v != null && v.startsWith(SECRET_VALUE_PREFIX) && v.length() > SECRET_VALUE_PREFIX.length(); }","tryCatchPattern":"try { apply(configValue); } catch (IllegalArgumentException e) { if (\"Failed to get secret.\".equals(e.getMessage())) { /* fix secret id or IAM permissions */ } else throw e; }","preventionTips":["Verify secret existence and IAM read permissions before deployment","Use exact, tested secret id formats in config files","Log (without leaking) which keys reference secrets for debugging"],"tags":["kafka","secrets","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}