{"record":{"id":"88fc4e01ef1a5c42","repo":"kestra-io/kestra","slug":"the-secret-function-cannot-be-called-with-both","errorCode":null,"errorMessage":"The 'secret' function cannot be called with both 'subkey' and 'full' arguments.","messagePattern":"The 'secret' function cannot be called with both 'subkey' and 'full' arguments\\.","errorType":"exception","errorClass":"PebbleException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/functions/SecretFunction.java","lineNumber":74,"sourceCode":"    public Object execute(Map<String, Object> args, PebbleTemplate self, EvaluationContext context, int lineNumber) {\n        String key = getSecretKey(args, self, lineNumber);\n        String namespace = (String) args.get(NAMESPACE_ARG);\n\n        Map<String, String> flow = (Map<String, String>) context.getVariable(\"flow\");\n        String flowNamespace = flow.get(NAMESPACE_ARG);\n        String flowTenantId = flow.get(\"tenantId\");\n\n        if (namespace == null) {\n            namespace = flowNamespace;\n        } else {\n            namespaceService.get().checkAllowedNamespace(flowTenantId, namespace, flowTenantId, flowNamespace);\n        }\n\n        final String subkey = (String) args.get(SUBKEY_ARG);\n        final boolean full = Boolean.TRUE.equals(args.get(FULL_ARG));\n\n        if (full && subkey != null && !subkey.isEmpty()) {\n            throw new PebbleException(null, \"The 'secret' function cannot be called with both 'subkey' and 'full' arguments.\", lineNumber, self.getName());\n        }\n\n        try {\n            if (full) {\n                SecretObject secretObject = secretService.get().findSecretObject(flowTenantId, namespace, key);\n                consumeSecret(context, secretObject.value());\n\n                Map<String, Object> result = new LinkedHashMap<>();\n                result.put(VALUE_KEY, secretObject.value());\n                if (!secretObject.metadata().isEmpty()) {\n                    secretObject.metadata().values().forEach(value -> consumeSecret(context, value));\n                    result.put(METADATA_KEY, secretObject.metadata());\n                }\n                return result;\n            }\n\n            String secret = secretService.get().findSecret(flowTenantId, namespace, key);\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/functions/SecretFunction.java#L56-L92","documentation":"The secret() function supports two modes: retrieving a single sub-key from a JSON secret (via 'subkey') or retrieving the full secret object with metadata (via 'full=true'). These modes are mutually exclusive because 'full' returns the entire secret as a structured object while 'subkey' extracts one field. Passing both makes the intent ambiguous and is rejected.","triggerScenarios":"Calling {{ secret('MY_KEY', subkey='password', full=true) }}. The 'full' argument resolves to true (either explicitly or via a variable) at the same time subkey is a non-empty string.","commonSituations":"Gradually migrating from subkey-based access to full-object access and forgetting to remove the old subkey argument. A flow input or variable populating both arguments conditionally. Template reuse where one branch sets subkey and another sets full, and both are active.","solutions":["Remove the 'subkey' argument when using full=true: {{ secret('MY_KEY', full=true) }}.","Or remove the 'full' argument when using subkey: {{ secret('MY_KEY', subkey='password') }}.","If branching logic needs both modes, use an if/else in Pebble to select one path at a time."],"exampleFix":"# before\n{{ secret('MY_KEY', subkey='password', full=true) }}\n\n# after — choose one mode\n{{ secret('MY_KEY', subkey='password') }}\n# or\n{{ secret('MY_KEY', full=true).value }}","handlingStrategy":"validation","validationCode":"# Never pass both subkey and full to secret().\n# Use conditional logic to select one mode:\n{% if inputs.full_mode %}{{ secret(inputs.key, full=true) }}{% else %}{{ secret(inputs.key, subkey=inputs.subkey) }}{% endif %}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Decide upfront whether you need a single sub-key or the full secret object.","Use if/else branching in Pebble to select one mode at a time.","Remove stale arguments when refactoring between subkey and full modes."],"tags":["pebble","secret","arguments","mutually-exclusive"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}