kestra-io/kestra · error · PebbleException

The 'encrypt' function expects two arguments 'key' and 'plai

Error message

The 'encrypt' function expects two arguments 'key' and 'plaintext'.

What it means

Thrown by the Pebble 'encrypt' template function when the args map is missing the 'key' or 'plaintext' entry. The function declares both as required positional arguments; Pebble only populates the map for arguments actually supplied at the call site, so omitting either (by position or by name) trips this guard before any crypto work is done.

Source

Thrown at core/src/main/java/io/kestra/core/runners/pebble/functions/EncryptFunction.java:32

    public static final String NAME = "encrypt";

    @Override
    public List<String> getArgumentNames() {
        return List.of("key", "plaintext");
    }

    @Override
    public Map<String, String> getArgumentDefaults() {
        return Map.of(
            "key", SecretFunction.NAME + "('encryption_key')",
            "plaintext", "'value_to_encrypt'"
        );
    }

    @Override
    public Object execute(Map<String, Object> args, PebbleTemplate self, EvaluationContext context, int lineNumber) {
        if (!args.containsKey("key") || !args.containsKey("plaintext")) {
            throw new PebbleException(null, "The 'encrypt' function expects two arguments 'key' and 'plaintext'.", lineNumber, self.getName());
        }

        String key = (String) args.get("key");
        String plaintext = (String) args.get("plaintext");
        try {
            return EncryptionService.encrypt(key, plaintext);
        } catch (GeneralSecurityException e) {
            throw new PebbleException(e, e.getMessage(), lineNumber, self.getName());
        }
    }
}

View on GitHub (pinned to 823fada927)

Solutions

1. Provide both arguments by position: encrypt(secret('ENCRYPTION_KEY'), 'value_to_encrypt').
2. If using named arguments, include both 'key' and 'plaintext' spelled exactly: encrypt(key=..., plaintext=...).
3. Remove any placeholder strings left from getArgumentDefaults() (e.g. "'value_to_encrypt'") and replace them with the real value.

Example fix

# before
enc: "{{ encrypt(secret('ENCRYPTION_KEY')) }}"
# after
enc: "{{ encrypt(secret('ENCRYPTION_KEY'), my_value) }}"

# Confirm both arguments are present before calling encrypt().
# {{ (key != null and plaintext != null) ? encrypt(key, plaintext) : null }}

When it happens

Trigger: Calling encrypt() with one argument, encrypt('only-one'), encrypt(plaintext='x') without key, encrypt(key='k') without plaintext, or encrypt() with no arguments. Also hit if an argument name is misspelled so Pebble does not bind it to 'key' or 'plaintext'.

Common situations: Forgetting the second argument in a quick template; autocompleting from getArgumentDefaults() and leaving a placeholder; renaming arguments; copy-pasting a decrypt() call pattern and forgetting encrypt() takes 'plaintext' not 'encrypted'.

Related errors

• GeneralSecurityException: e.getMessage()
• The 'env' function expects an argument 'name'.
• The 'fromIon' function expects an argument 'ion'.
• The 'fromJson' function expects an argument 'json'.
• The 'hourOfDay()' function expects a 'date' argument.

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/991d2addc3dc8b95. Report an issue: GitHub.