{"record":{"id":"3dfb78f571c82455","repo":"apache/beam","slug":"failed-to-retrieve-secret-bytes","errorCode":null,"errorMessage":"Failed to retrieve secret bytes","messagePattern":"Failed to retrieve secret bytes","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java","lineNumber":140,"sourceCode":"                + \"Please specify 'project' in the secret spec, set GOOGLE_CLOUD_PROJECT environment variable, \"\n                + \"or configure Application Default Credentials.\",\n            context != null ? \" for \" + context : \"\"));\n  }\n\n  /**\n   * Returns the secret as a byte array. Assumes that the current active service account has\n   * permissions to read the secret.\n   *\n   * @return The secret as a byte array.\n   */\n  @Override\n  public byte[] getSecretBytes() {\n    try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {\n      SecretVersionName secretVersionName = SecretVersionName.parse(versionName);\n      AccessSecretVersionResponse response = client.accessSecretVersion(secretVersionName);\n      return response.getPayload().getData().toByteArray();\n    } catch (IOException e) {\n      throw new RuntimeException(\"Failed to retrieve secret bytes\", e);\n    }\n  }\n\n  /**\n   * Returns the version name of the secret.\n   *\n   * @return The version name as a String.\n   */\n  public String getVersionName() {\n    return versionName;\n  }\n\n  @Override\n  public boolean equals(@Nullable Object obj) {\n    if (this == obj) {\n      return true;\n    }\n    if (!(obj instanceof GcpSecret)) {","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/util/GcpSecret.java#L122-L158","documentation":"GcpSecret.getSecretBytes opens a SecretManagerServiceClient and accesses the secret version; if client creation or the access call throws IOException it is wrapped in RuntimeException('Failed to retrieve secret bytes', cause). Note: API-level errors like NOT_FOUND surface as ApiException (runtime), so this wrap mostly covers transport/credential IO problems.","triggerScenarios":"SecretManagerServiceClient.create() failing due to credentials/environment IO issues; network failure during accessSecretVersion; ADC cannot be loaded (IOException path).","commonSituations":"No Application Default Credentials configured (missing GOOGLE_APPLICATION_CREDENTIALS file); network/proxy blocking secretmanager.googleapis.com; quota or connection reset errors.","solutions":["Read the chained cause for the underlying IOException","Configure credentials: set GOOGLE_APPLICATION_CREDENTIALS or run gcloud auth application-default login","Verify network access to secretmanager.googleapis.com:443","Confirm the version name parses and exists (invalid names usually surface as ApiException, not this wrap)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (System.getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == null\n    && GoogleCredentials.getApplicationDefault() == null) {\n  throw new IllegalStateException(\"No ADC credentials available for Secret Manager\");\n}","typeGuard":null,"tryCatchPattern":"try { byte[] b = secret.getSecretBytes(); }\ncatch (RuntimeException e) {\n  LOG.error(\"Secret bytes unavailable: \" + e.getCause(), e.getCause());\n  throw new IOException(\"Secret retrieval failed; check credentials/network\", e);\n}","preventionTips":["Verify ADC works with gcloud auth application-default print-access-token","Allow egress to secretmanager.googleapis.com:443","Catch ApiException separately to distinguish NOT_FOUND/PERMISSION_DENIED from IO failures"],"tags":["gcp","secret-manager","io","network","java"],"backgroundTag":"file-read-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}