{"record":{"id":"df685f2c7efc9931","repo":"apache/pulsar","slug":"failed-to-create-authentication-secret-for-functio","errorCode":null,"errorMessage":"Failed to create authentication secret for function %s/%s/%s","messagePattern":"Failed to create authentication secret for function (.+?)/(.+?)/(.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesSecretsTokenAuthProvider.java","lineNumber":404,"sourceCode":"                                .success(false)\n                                .errorMsg(errorMsg)\n                                .build();\n                    }\n\n                    sb.append(id.toCharArray());\n                    return Actions.ActionResult.builder().success(true).build();\n                })\n                .build();\n\n        AtomicBoolean success = new AtomicBoolean(false);\n        Actions.newBuilder()\n                .addAction(createAuthSecret.toBuilder()\n                        .onSuccess(ignore -> success.set(true))\n                        .build())\n                .run();\n\n        if (!success.get()) {\n            throw new RuntimeException(\n                    String.format(\"Failed to create authentication secret for function %s/%s/%s\", tenant, namespace,\n                            name));\n        }\n\n        return sb.toString();\n    }\n\n    private String getSecretName(String id) {\n        return \"pf-secret-\" + id;\n    }\n}\n","sourceCodeStart":386,"sourceCodeEnd":416,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesSecretsTokenAuthProvider.java#L386-L416","documentation":"createSecret (called from cacheAuthData) creates a new Kubernetes secret holding the function's auth token/data via a kubernetes-client action list, waiting on a success AtomicBoolean. If creation doesn't succeed it throws RuntimeException 'Failed to create authentication secret for function <tenant>/<namespace>/<name>'.","triggerScenarios":"Kubernetes API create failure during cacheAuthData: RBAC denied, namespace doesn't exist, secret already exists in a conflicting state, connection failure, or payload too large.","commonSituations":"Function worker without 'create' permission on secrets; deploying functions into a namespace that doesn't exist; oversized token/auth data; network policy blocking API access from workers.","solutions":["Ensure RBAC allows the worker service account to create secrets in the namespace","Verify the tenant/namespace Kubernetes namespace exists before deploying the function","Check secret payload size (etcd ~1MB limit) and shrink auth data if needed","Inspect kubectl events/logs for the root API error and retry after fixing"],"exampleFix":"// before\n# namespace missing\n// after\nkubectl create namespace <tenant-ns>\nkubectl create role secret-creator --verb=create,get --resource=secrets -n <tenant-ns>\nkubectl create rolebinding fn-worker-secret-creator --role=secret-creator \\\n  --serviceaccount=<tenant-ns>:function-worker -n <tenant-ns>","handlingStrategy":"retry","validationCode":"// preflight before deploying\n// kubectl auth can-i create secrets --as=system:serviceaccount:<ns>:function-worker -n <ns>\n// kubectl get namespace <ns>","typeGuard":null,"tryCatchPattern":"try {\n    provider.cacheAuthData(funcDetails, cache);\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Failed to create authentication secret\")) {\n        // ensure namespace exists and RBAC allows create; retry\n    }\n}","preventionTips":["Create the target k8s namespace before deploying functions","Ensure secret-create RBAC for the worker SA","Validate auth payload size and API connectivity before caching"],"tags":["kubernetes","secrets","rbac"],"backgroundTag":"kubernetes-secret-operation-failed","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}