diff --git a/pkg/modules/generators/app_configurations_generator.go b/pkg/modules/generators/app_configurations_generator.go
index 5b6bddc2a..c75fe7545 100644
--- a/pkg/modules/generators/app_configurations_generator.go
+++ b/pkg/modules/generators/app_configurations_generator.go
@@ -141,14 +141,18 @@ func (g *appConfigurationGenerator) Generate(spec *v1.Spec) error {
 	namespace := g.getNamespaceName()
 	gfs := []modules.NewGeneratorFunc{
 		NewNamespaceGeneratorFunc(namespace),
+	}
+
+	if g.app.Workload != nil {
 		// todo: refactor secret into a module
-		secret.NewSecretGeneratorFunc(&secret.GeneratorRequest{
+		gfs = append(gfs, secret.NewSecretGeneratorFunc(&secret.GeneratorRequest{
 			Project:     g.project.Name,
 			Namespace:   namespace,
 			Workload:    g.app.Workload,
 			SecretStore: g.ws.SecretStore,
-		}),
+		}))
 	}
+
 	if err = modules.CallGenerators(spec, gfs...); err != nil {
 		return err
 	}
@@ -160,7 +164,9 @@ func (g *appConfigurationGenerator) Generate(spec *v1.Spec) error {
 	}
 
 	// append the generated resources to the spec
-	spec.Resources = append(spec.Resources, *wl)
+	if wl != nil {
+		spec.Resources = append(spec.Resources, *wl)
+	}
 	spec.Resources = append(spec.Resources, resources...)
 
 	// patch workload with resource patchers
@@ -246,6 +252,11 @@ func PatchWorkload(workload *v1.Resource, patcher *v1.Patcher) error {
 		return nil
 	}
 
+	if workload == nil {
+		log.Info("workload is nil, return")
+		return nil
+	}
+
 	un := &unstructured.Unstructured{}
 	attributes := workload.Attributes
 
@@ -500,7 +511,9 @@ func (g *appConfigurationGenerator) buildModuleConfigIndex(platformModuleConfigs
 	for k, v := range g.app.Accessories {
 		tempMap[k] = v
 	}
-	tempMap["workload"] = g.app.Workload
+	if g.app.Workload != nil {
+		tempMap["workload"] = g.app.Workload
+	}
 
 	for accName, accessory := range tempMap {
 		// parse accessory module key
@@ -525,6 +538,11 @@ func (g *appConfigurationGenerator) buildModuleConfigIndex(platformModuleConfigs
 // parseModuleKey returns the module key of the accessory in format of "org/module@version"
 // example: "kusionstack/mysql@v0.1.0"
 func parseModuleKey(accessory v1.Accessory, dependencies *pkg.Dependencies) (string, error) {
+	if accessory == nil {
+		log.Info("accessory is nil, return empty module key")
+		return "", nil
+	}
+
 	moduleName, err := getModuleName(accessory)
 	if err != nil {
 		return "", err
diff --git a/pkg/modules/generators/secret/secret.go b/pkg/modules/generators/secret/secret.go
index 954d44da3..ff476beb3 100644
--- a/pkg/modules/generators/secret/secret.go
+++ b/pkg/modules/generators/secret/secret.go
@@ -10,6 +10,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	v1 "kusionstack.io/kusion/pkg/apis/api.kusion.io/v1"
+	"kusionstack.io/kusion/pkg/log"
 	"kusionstack.io/kusion/pkg/modules"
 )
 
@@ -37,6 +38,11 @@ func NewSecretGenerator(request *GeneratorRequest) (modules.Generator, error) {
 	}
 
 	secretMap := make(map[string]v1.Secret)
+
+	if request.Workload == nil {
+		log.Infof("workload is missing, no secret will be generated")
+		return &secretGenerator{}, nil
+	}
 	secrets := request.Workload["secrets"]
 	if secrets != nil {
 		out, err := yaml.Marshal(secrets)