Expected Behavior

When oauth2ClientSecretPath is configured, the Pulsar component should work identically to using oauth2ClientSecret (inline). The component should read the client secret from the file, use it to fetch OAuth2 tokens from the token endpoint, and provide those tokens to the Pulsar client with automatic refresh.

Actual Behavior

The component fails to initialize when using oauth2ClientSecretPath. The OAuth2 token is successfully fetched from the token endpoint, but then the component fails with:

Failed to init component pulsar-pubsub (pubsub.pulsar/v1): [INIT_COMPONENT_FAILURE]: initialization error occurred for pulsar-pubsub (pubsub.pulsar/v1): could not instantiate pulsar client: open /snp/resources/evmg-oauth2-credentials.json: no such file or directory

The component attempts to read the credentials file again as if it contains a raw token, but the file contains OAuth2 credentials (client_id, client_secret) in JSON format, not a token string. This causes initialization to fail.

Using oauth2ClientSecret (inline) works correctly, confirming the bug is specific to the file-based path.

Steps to Reproduce the Problem

1. Deploy Pulsar with OAuth2 authentication enabled
2. Create a credentials file (JSON format) containing OAuth2 client credentials:

   {
     "issuer_url": "http://oauth-server:8080/default",
     "grant_type": "client_credentials",
     "client_secret": "your-secret",
     "client_id": "your-client-id"
   }

3. Mount this file as a ConfigMap/Secret in the Dapr sidecar container
4. Configure the Pulsar component with oauth2ClientSecretPath:

   apiVersion: dapr.io/v1alpha1
   kind: Component
   metadata:
     name: pulsar-pubsub
   spec:
     type: pubsub.pulsar
     version: v1
     metadata:
     - name: host
       value: "pulsar-broker:6650"
     - name: oauth2TokenURL
       value: "http://oauth-server:8080/default/token"
     - name: oauth2ClientID
       value: "your-client-id"
     - name: oauth2ClientSecretPath
       value: "/path/to/credentials.json"
     - name: oauth2Audiences
       value: "pulsar"
     - name: oauth2Scopes
       value: "openid"

5. Deploy an application that uses this component
6. Component fails to initialize with the error shown above

Release Note

RELEASE NOTE: FIX Pulsar pubsub component initialization when using oauth2ClientSecretPath.