{"record":{"id":"844c05cf055afd0c","repo":"apache/pulsar","slug":"kubernetes-secret-should-contain-id-information","errorCode":null,"errorMessage":"Kubernetes Secret should contain id information","messagePattern":"Kubernetes Secret should contain id information","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java","lineNumber":132,"sourceCode":"\n    // The secret object should be of type Map<String, String> and it should contain \"id\" and \"key\"\n    @Override\n    public void doAdmissionChecks(AppsV1Api appsV1Api, CoreV1Api coreV1Api, String jobNamespace, String jobName,\n                                  FunctionDetails functionDetails) {\n        if (!StringUtils.isEmpty(functionDetails.getSecretsMap())) {\n            Type type = new TypeToken<Map<String, Object>>() {\n            }.getType();\n            Map<String, Object> secretsMap = new Gson().fromJson(functionDetails.getSecretsMap(), type);\n\n            for (Object object : secretsMap.values()) {\n                if (object instanceof Map) {\n                    @SuppressWarnings(\"unchecked\") // secret values are expected to be Map<String, String>\n                    Map<String, String> kubernetesSecret = (Map<String, String>) object;\n                    if (kubernetesSecret.size() < 2) {\n                        throw new IllegalArgumentException(\"Kubernetes Secret should contain id and key\");\n                    }\n                    if (!kubernetesSecret.containsKey(idKey)) {\n                        throw new IllegalArgumentException(\"Kubernetes Secret should contain id information\");\n                    }\n                    if (!kubernetesSecret.containsKey(keyKey)) {\n                        throw new IllegalArgumentException(\"Kubernetes Secret should contain key information\");\n                    }\n                } else {\n                    throw new IllegalArgumentException(\"Kubernetes Secret should be a Map containing id/key pairs\");\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":114,"sourceCodeEnd":144,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/secrets/src/main/java/org/apache/pulsar/functions/secretsproviderconfigurator/KubernetesSecretsProviderConfigurator.java#L114-L144","documentation":"In doAdmissionChecks, each Kubernetes secret entry must be a Map containing the reserved id key ('id') identifying the Kubernetes Secret name. When the entry is a Map of at least 2 entries but lacks the idKey field, this IllegalArgumentException is thrown.","triggerScenarios":"doAdmissionChecks receives a secrets map entry like {\"password\": \"...\", \"user\": \"...\"} or {\"key\": \"password\"} — a Map whose keys do not include 'id' — instead of {\"id\": \"<secret-name>\", \"key\": \"<key>\"}.","commonSituations":"developers pass the raw secret contents (key/value pairs inside the secret) instead of the reference metadata; confusion with ClearSecretsProvider format which takes different fields; renaming id field to name/path/secretName.","solutions":["Rename/add the 'id' field in each secret entry to the Kubernetes Secret's name","Use exactly the shape {\"id\": \"<kubernetes-secret-name>\", \"key\": \"<key-within-secret>\"} for each exposed secret","Check the configurator's idKey constant to confirm the expected field name for your Pulsar version"],"exampleFix":"// before\nsecrets: {\"mysecret\": {\"name\": \"db-creds\", \"key\": \"password\"}}\n// after\nsecrets: {\"mysecret\": {\"id\": \"db-creds\", \"key\": \"password\"}}","handlingStrategy":"validation","validationCode":"void requireSecretId(Map<String, Object> secrets) {\n    for (Map.Entry<String, Object> e : secrets.entrySet()) {\n        Map<?, ?> m = (Map<?, ?>) e.getValue();\n        if (!m.containsKey(\"id\")) {\n            throw new IllegalArgumentException(\"Secret '\" + e.getKey() + \"' missing 'id' (k8s secret name)\");\n        }\n    }\n}","typeGuard":"static boolean hasSecretId(Object v) {\n    return v instanceof Map<?, ?> m && m.containsKey(\"id\");\n}","tryCatchPattern":"try {\n    admin.functions().updateFunction(functionConfig);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"id information\")) { /* add 'id' field to secret entries */ }\n}","preventionTips":["Use the field name 'id' exactly — not name/path/secretName","Keep a shared JSON schema for your function configs and validate against it","Copy secret formats from official Pulsar K8s examples"],"tags":["kubernetes","secrets","validation","pulsar-functions"],"backgroundTag":"secret-config-validation","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}