{"record":{"id":"25fbbff2eb2cc5b1","repo":"apache/beam","slug":"the-kerberosconsumerfactoryfn-requires-a-location-for-the","errorCode":null,"errorMessage":"The KerberosConsumerFactoryFn requires a location for the krb5.conf file. Please provide either a GCS location or Google Secret Manager location for this file.","messagePattern":"The KerberosConsumerFactoryFn requires a location for the krb5\\.conf file\\. Please provide either a GCS location or Google Secret Manager location for this file\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/kafka/src/main/java/org/apache/beam/sdk/io/kafka/KafkaIO.java","lineNumber":963,"sourceCode":"              && config.offsetDeduplication != null) {\n            builder.setOffsetDeduplication(config.offsetDeduplication);\n          }\n          if (config.redistribute && config.redistributeByRecordKey != null) {\n            builder.setRedistributeByRecordKey(config.redistributeByRecordKey);\n          }\n        } else {\n          builder.setRedistributed(false);\n          builder.setRedistributeNumKeys(0);\n          builder.setAllowDuplicates(false);\n          builder.setOffsetDeduplication(false);\n          builder.setRedistributeByRecordKey(false);\n        }\n\n        if (config.consumerFactoryFnClass != null) {\n          if (config.consumerFactoryFnClass.contains(\"KerberosConsumerFactoryFn\")) {\n            try {\n              if (!config.consumerFactoryFnParams.containsKey(\"krb5Location\")) {\n                throw new IllegalArgumentException(\n                    \"The KerberosConsumerFactoryFn requires a location for the krb5.conf file. \"\n                        + \"Please provide either a GCS location or Google Secret Manager location for this file.\");\n              }\n              String krb5Location = config.consumerFactoryFnParams.get(\"krb5Location\");\n              builder.setConsumerFactoryFn(\n                  InstanceBuilder.ofType(\n                          new TypeDescriptor<\n                              SerializableFunction<\n                                  Map<String, Object>, Consumer<byte[], byte[]>>>() {})\n                      .fromClassName(config.consumerFactoryFnClass)\n                      .withArg(String.class, Objects.requireNonNull(krb5Location))\n                      .build());\n            } catch (Exception e) {\n              throw new RuntimeException(\n                  \"Unable to construct FactoryFn \"\n                      + config.consumerFactoryFnClass\n                      + \": \"\n                      + e.getMessage(),","sourceCodeStart":945,"sourceCodeEnd":981,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/kafka/src/main/java/org/apache/beam/sdk/io/kafka/KafkaIO.java#L945-L981","documentation":"When the external KafkaIO config selects KerberosConsumerFactoryFn as the consumer factory, a 'krb5Location' parameter is mandatory — it must point to the krb5.conf file stored in GCS or Google Secret Manager. setupExternalBuilder throws IllegalArgumentException when that key is missing.","triggerScenarios":"Setting consumerFactoryFnClass to a class containing 'KerberosConsumerFactoryFn' while consumerFactoryFnParams does not contain the key 'krb5Location'.","commonSituations":"Kerberized Kafka clusters on GCP Dataflow where the operator forgot the krb5.conf parameter; renaming the parameter key (e.g. 'krb5.conf' instead of 'krb5Location'); switching to the Kerberos factory without updating params.","solutions":["Add the 'krb5Location' entry to consumerFactoryFnParams pointing to the krb5.conf in GCS or Secret Manager.","Verify the key is spelled exactly 'krb5Location'.","Upload krb5.conf to GCS/Secret Manager if it isn't stored there yet.","Switch to a non-Kerberos consumer factory if Kerberos is not needed."],"exampleFix":"// before\nconsumerFactoryFnParams: {}\n// after\nconsumerFactoryFnParams: {\"krb5Location\": \"gs://my-bucket/security/krb5.conf\"}","handlingStrategy":"validation","validationCode":"if (cls.contains(\"KerberosConsumerFactoryFn\") && !params.containsKey(\"krb5Location\")) throw new IllegalArgumentException(\"krb5Location required\");","typeGuard":null,"tryCatchPattern":"try { build(cfg); } catch (IllegalArgumentException e) { addKrb5Param(); }","preventionTips":["Always set krb5Location with the Kerberos factory"],"tags":["kafka","kerberos","configuration","missing-parameter","gcp"],"backgroundTag":"missing-required-config-field","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}