{"record":{"id":"79ab7adb0dfa8037","repo":"apache/pulsar","slug":"kubernetessecretsproviderconfigurator-should-only","errorCode":null,"errorMessage":"KubernetesSecretsProviderConfigurator should only be setup for Kubernetes Runtime","messagePattern":"KubernetesSecretsProviderConfigurator should only be setup for Kubernetes Runtime","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java","lineNumber":106,"sourceCode":"            Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);\n            for (Map.Entry<String, Object> entry : secretsMap.entrySet()) {\n                final V1EnvVar secretEnv = new V1EnvVar();\n                @SuppressWarnings(\"unchecked\") // secret values are expected to be Map<String, String>\n                Map<String, String> kv = (Map<String, String>) entry.getValue();\n                secretEnv.name(entry.getKey())\n                        .valueFrom(new V1EnvVarSource()\n                                .secretKeyRef(new V1SecretKeySelector()\n                                        .name(kv.get(idKey))\n                                        .key(kv.get(keyKey))));\n                container.addEnvItem(secretEnv);\n            }\n        }\n    }\n\n    @Override\n    public void configureProcessRuntimeSecretsProvider(ProcessBuilder processBuilder,\n                                                       FunctionDetails functionDetails) {\n        throw new RuntimeException(\"KubernetesSecretsProviderConfigurator should only be setup for Kubernetes Runtime\");\n    }\n\n    @Override\n    public Type getSecretObjectType() {\n        return new TypeToken<Map<String, String>>() {\n        }.getType();\n    }\n\n    // The secret object should be of type Map<String, String> and it should contain \"id\" and \"key\"\n    @Override\n    public void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, String jobName,\n                                  FunctionDetails functionDetails) {\n        if (!StringUtils.isEmpty(functionDetails.getSecretsMap())) {\n            Type type = new TypeToken<Map<String, Object>>() {\n            }.getType();\n            Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);\n\n            for (Object object : secretsMap.values()) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java#L88-L124","documentation":"KubernetesSecretsProviderConfigurator implements SecretsProviderConfigurator but only supports the Kubernetes runtime. When the broker/function worker is configured with this configurator but a function is submitted to run as a process (or thread) runtime instead of Kubernetes, configureProcessRuntimeSecretsProvider is invoked and immediately throws this RuntimeException to signal the configurator is being used in an unsupported runtime mode.","triggerScenarios":"A function is submitted with functionConfig/exposed secrets while the worker's secretsProviderConfigurator class is set to KubernetesSecretsProviderConfigurator, but the function runs on the 'process' (or 'thread') runtime instead of the 'kubernetes' runtime, so the framework calls configureProcessRuntimeSecretsProvider.","commonSituations":"operators switch functions.runtime to 'process' in worker config (or submit a function with runtime override) while leaving secretsProviderConfigurator=org.apache.pulsar.functions.secretsproviderconfigurator.KubernetesSecretsProviderConfigurator in functions_worker.yml on a Kubernetes cluster; migration of functions from K8s runtime to process runtime without changing the secrets configurator.","solutions":["Set functions runtime to 'kubernetes' in functions_worker.yml (functionsWorkerCustomConfigs / overrideFunctionConfig) or submit the function with the kubernetes runtime so this method is never called","Change worker's secretsProviderConfigurator to DefaultSecretsProviderConfigurator (or another process-runtime-compatible configurator) if functions must run as process/thread runtime","Pass the secrets as plain config through a different SecretsProvider (e.g. ClearSecretsProvider) compatible with process runtimes"],"exampleFix":"// before (functions_worker.yml)\nsecretsProviderConfiguratorClassName: org.apache.pulsar.functions.secretsproviderconfigurator.KubernetesSecretsProviderConfigurator\nfunctionsWorkerCustomConfigs:\n  functionsRuntime: PROCESS\n// after\nsecretsProviderConfiguratorClassName: org.apache.pulsar.functions.secretsproviderconfigurator.KubernetesSecretsProviderConfigurator\nfunctionsWorkerCustomConfigs:\n  functionsRuntime: KUBERNETES\n# ...or keep PROCESS and switch to:\n# secretsProviderConfiguratorClassName: org.apache.pulsar.functions.secretsproviderconfigurator.DefaultSecretsProviderConfigurator","handlingStrategy":"validation","validationCode":"boolean usesK8sSecretsConfigurator = \"org.apache.pulsar.functions.secretsproviderconfigurator.KubernetesSecretsProviderConfigurator\"\n        .equals(workerConfig.getSecretsProviderConfiguratorClassName());\nboolean k8sRuntime = \"KUBERNETES\".equalsIgnoreCase(runtime);\nif (usesK8sSecretsConfigurator && !k8sRuntime) {\n    throw new IllegalStateException(\"KubernetesSecretsProviderConfigurator requires the Kubernetes runtime\");\n}","typeGuard":"static boolean isKubernetesRuntime(ObjectRuntimeConfig cfg) {\n    return cfg != null && \"KUBERNETES\".equalsIgnoreCase(cfg.getRuntime());\n}","tryCatchPattern":null,"preventionTips":["Keep worker runtime and secretsProviderConfigurator consistent in functions_worker.yml","Add a startup config check in the worker that fails fast on this combination","Prefer DefaultSecretsProviderConfigurator for non-Kubernetes deployments"],"tags":["kubernetes","pulsar-functions","secrets","configuration"],"backgroundTag":"runtime-mismatch-config","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}