{"record":{"id":"79c8c6d2652bdc6a","repo":"apache/pulsar","slug":"pulsaradmin-is-not-enabled-in-function-worker","errorCode":null,"errorMessage":"PulsarAdmin is not enabled in function worker","messagePattern":"PulsarAdmin is not enabled in function worker","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/instance/src/main/java/org/apache/pulsar/functions/instance/ContextImpl.java","lineNumber":378,"sourceCode":"    public Map<String, Object> getUserConfigMap() {\n        return userConfigs;\n    }\n\n    @Override\n    public String getSecret(String secretName) {\n        if (secretsMap.containsKey(secretName)) {\n            return secretsProvider.provideSecret(secretName, secretsMap.get(secretName));\n        } else {\n            return null;\n        }\n    }\n\n    @Override\n    public PulsarAdmin getPulsarAdmin() {\n        if (exposePulsarAdminClientEnabled) {\n            return pulsarAdmin;\n        } else {\n            throw new IllegalStateException(\"PulsarAdmin is not enabled in function worker\");\n        }\n    }\n\n    @Override\n    public <T extends StateStore> T getStateStore(String name) {\n        return getStateStore(\n            config.getFunctionDetails().getTenant(),\n            config.getFunctionDetails().getNamespace(),\n            name);\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Override\n    public <T extends StateStore> T getStateStore(String tenant, String ns, String name) {\n        return (T) stateManager.getStore(tenant, ns, name);\n    }\n\n    private void ensureStateEnabled() {","sourceCodeStart":360,"sourceCodeEnd":396,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/instance/src/main/java/org/apache/pulsar/functions/instance/ContextImpl.java#L360-L396","documentation":"getPulsarAdmin() exposes a PulsarAdmin client to functions/connectors only when the worker explicitly enables it via exposePulsarAdminClientEnabled. When the flag is false (the safe default), any call throws IllegalStateException because the framework refuses to hand an admin client to untrusted user code.","triggerScenarios":"User code (function, source, sink) calls context.getPulsarAdmin() while the function worker has `exposePulsarAdminClientEnabled=false` (default) in its configuration.","commonSituations":"Connectors like the ElasticSearch sink that require an admin client deployed on a worker where the flag was never enabled; copying connector code into a function on a default-configured cluster.","solutions":["Set `exposePulsarAdminClientEnabled=true` in the function worker's configuration and restart the workers.","If enabling admin access is not acceptable, restructure the code to use the regular Pulsar client (context.getPulsarClient()) instead of admin operations.","Check worker config actually took effect (correct conf file, no stale workers) after changing the flag."],"exampleFix":"// before (worker config)\nexposePulsarAdminClientEnabled=false\n// after\nexposePulsarAdminClientEnabled=true","handlingStrategy":"validation","validationCode":"// before calling getPulsarAdmin, confirm worker conf has:\n// exposePulsarAdminClientEnabled=true\nboolean adminEnabled = Boolean.getBoolean(\"pulsar.functions.exposePulsarAdminClientEnabled\");","typeGuard":null,"tryCatchPattern":"try { PulsarAdmin admin = context.getPulsarAdmin(); ... } catch (IllegalStateException e) { /* fall back to PulsarClient-only operations */ }","preventionTips":["Enable exposePulsarAdminClientEnabled in worker config before deploying connectors needing admin","Document the requirement in connector deployment docs","Prefer PulsarClient operations when admin APIs are not strictly needed"],"tags":["pulsar-functions","configuration","pulsar-admin","security"],"backgroundTag":"admin-client-not-enabled","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}