{"record":{"id":"e6abf3d1197360b2","repo":"apache/beam","slug":"error-matching-values-secret-was-discovered-but-its-value-is","errorCode":null,"errorMessage":"Error matching values. Secret was discovered but its value is null","messagePattern":"Error matching values\\. Secret was discovered but its value is null","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/kafka-factories/src/main/java/org/apache/beam/sdk/extensions/kafka/factories/KerberosConsumerFactoryFn.java","lineNumber":113,"sourceCode":"              super.getBaseDirectory() + \"/\" + LOCAL_FACTORY_TYPE + \"/\" + \"krb5.conf\";\n          localKrb5ConfPath = downloadExternalFile(this.krb5ConfigPath, localPath);\n\n          System.setProperty(\"java.security.krb5.conf\", localKrb5ConfPath);\n          Configuration.getConfiguration().refresh();\n        }\n      }\n    }\n  }\n\n  @Override\n  protected String processSecret(String originalValue, String secretId, byte[] secretValue)\n      throws RuntimeException {\n    Matcher matcher = KEYTAB_SECRET_PATTERN.matcher(originalValue);\n    String localFileString = \"\";\n    while (matcher.find()) {\n      String currentSecretId = matcher.group(1);\n      if (currentSecretId == null || currentSecretId.isEmpty()) {\n        throw new RuntimeException(\n            \"Error matching values. Secret was discovered but its value is null\");\n      }\n      currentSecretId = currentSecretId.substring(KEYTAB_SECRET_PREFIX.length());\n      if (!currentSecretId.equals(secretId)) {\n        // A sasl.jaas.config can contain multiple keytabs in one string. Therefore, we must assume\n        // that there can\n        // also be multiple keytab secrets in the same string. If the currently matched secret does\n        // not equal\n        // the secret that we are processing (passed in via secretId) then we do not want to create\n        // a keytab file and overwrite it.\n        continue;\n      }\n      String filename = \"kafka-client-\" + UUID.randomUUID().toString() + \".keytab\";\n\n      localFileString = super.getBaseDirectory() + \"/\" + LOCAL_FACTORY_TYPE + \"/\" + filename;\n      Path localFilePath = Paths.get(localFileString);\n      Path parentDir = localFilePath.getParent();\n      try {","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/kafka-factories/src/main/java/org/apache/beam/sdk/extensions/kafka/factories/KerberosConsumerFactoryFn.java#L95-L131","documentation":"processSecret() writes the fetched secret bytes to the local keytab path with Files.write(). If writing throws IOException, a RuntimeException with this message is thrown. Notably the original IOException is NOT chained, so the underlying reason must be inferred from context/logs.","triggerScenarios":"Files.write fails on the resolved local path: parent directory doesn't exist, disk full, or the worker process lacks write permission on the target directory.","commonSituations":"Read-only container filesystem; staging directory wiped between secret fetch and write; path collisions/permission issues on the worker; large keytab exceeding temp space.","solutions":["Check worker logs around the failure for permission or missing-directory errors (cause is swallowed)","Ensure the local keytab directory exists and is writable by the worker process before the pipeline runs","Run the worker with a writable temp/staging volume","Retest by writing a dummy file to the same localFilePath in the worker image"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"java\nif (saslJaasConfig.matches(\".*\" + Pattern.quote(KEYTAB_SECRET_PREFIX) + \"\\\\s*(\\\\s|\\\"|$).*\")) {\n  throw new IllegalArgumentException(\"sasl.jaas.config contains an empty keytab secret reference\");\n}","typeGuard":null,"tryCatchPattern":"java\ntry {\n  factoryFn.processSecret(config);\n} catch (RuntimeException ex) {\n  if (ex.getMessage().contains(\"Secret was discovered but its value is null\")) {\n    log.severe(\"Incomplete keytab secret reference in sasl.jaas.config\");\n  }\n}","preventionTips":["Ensure template variables are substituted before config reaches the pipeline","Fail fast on empty template placeholders in CI config validation","Avoid literal occurrences of the secret prefix in unrelated values","Review hand-edited sasl.jaas.config for truncated references"],"tags":["java","kafka","kerberos","file-write"],"backgroundTag":"file-write-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}