quarkusio/quarkus · error · IllegalArgumentException

'%s' env var can't simultaneously take its value from '%s' c

Error message

'%s' env var can't simultaneously take its value from '%s' configmap & '%s' secret

What it means

KubernetesEnvBuildItem.create() is the single factory validating env var sources for Kubernetes manifests. Quarkus forbids an env var whose value simultaneously comes from a configmap and a secret, since the generated env entry can have only one valueFrom source. When both configmap and secret are non-null (and a name is given), it throws this IllegalArgumentException.

Source

Thrown at extensions/kubernetes/spi/src/main/java/io/quarkus/kubernetes/spi/KubernetesEnvBuildItem.java:89

    public static KubernetesEnvBuildItem createFromSecretKey(String varName, String key, String secret, String target,
            String prefix) {
        return create(varName, key, secret, null, null, target, prefix);
    }

    public static KubernetesEnvBuildItem createFromResourceKey(String varName, String key, String secret,
            String configmap, String target) {
        return create(varName, key, secret, configmap, null, target, null);
    }

    public static KubernetesEnvBuildItem create(String name, String value, String secret, String configmap, String field,
            String target, String prefix) throws IllegalArgumentException {
        final boolean secretPresent = secret != null;
        final boolean configmapPresent = configmap != null;
        final boolean valuePresent = value != null;
        final boolean fieldPresent = field != null;
        if (valuePresent) {
            if (secretPresent && configmapPresent) {
                throw new IllegalArgumentException(String.format(
                        "'%s' env var can't simultaneously take its value from '%s' configmap & '%s' secret",
                        name, configmap, secret));
            }
            if (fieldPresent) {
                throw new IllegalArgumentException(String.format(
                        "'%s' env var can't simultaneously have a '%s' value & take is value from the '%s' field",
                        name, value, field));
            }
        }
        if (secretPresent && configmapPresent) {
            log.warn(String.format("The '%s' name was used to try to import both from '%s' secret & '%s' configmap. " +
                    "Only values from '%s' secret will be imported.\nIf you want to import from both, use a " +
                    "different property name for either.",
                    name, secret,
                    configmap,
                    secret));
        }
        final EnvType type;

View on GitHub (pinned to e1c734241f)

Solutions

1. Provide only one source: either the configmap or the secret, not both
2. Split into two env entries or use secretRef/configMapKeyRef selection on a single source
3. If you need values from both, create two separate KubernetesEnvBuildItem entries with different names
4. Check application.properties: remove either the .configmap or .secret qualifier for that env var

Example fix

// before
quarkus.kubernetes.env-vars.my.env=configmap:my-cm,secret:my-secret
// after
quarkus.kubernetes.env-vars.my.env=secret:my-secret

if (configMap != null && secret != null) throw new IllegalStateException("Env var '" + name + "' must use either configmap or secret, not both");

static boolean hasSingleSource(String configmap, String secret) {
    return (configmap == null) != (secret == null);
}

try { KubernetesEnvBuildItem.create(name, secret, configmap, value, field, explicit); } catch (IllegalArgumentException e) { /* fix config: single source only */ }

When it happens

Trigger: Calling KubernetesEnvBuildItem.create(name, secret, configmap, ...) with both secret and configmap non-null — e.g. via the old createFromConfigMap/createFromSecret shortcuts combined or deprecated factory paths passing both.

Common situations: application.properties style config migrating from quarkus.kubernetes.env-vars where users set both configmap and secret fields for the same var; programmatic build item creation passing both parameters; misread docs where configmap and secret fields look combinable.

Related errors

• '%s' env var can't simultaneously have a '%s' value & take i
• When generating a CronJob resource, you need to specify a sc
• No role has been set in the RoleBinding resource!
• No subjects have been set in the ClusterRoleBinding resource
• Could not find DeploymentResourceKind for

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/604e523fa95e6a7c. Report an issue: GitHub.