Kubernetes — CreateContainerConfigError from a missing secret key
Resolve Kubernetes secret key errors by verifying the secret exists, holds the key and is mounted correctly.
Symptoms
- CreateContainerConfigError: secret "app-secrets" not found
- The pod never starts and shows a config error
- The secret exists but a key reference is missing
- It works in one namespace but not another
Possible causes
- The referenced secret is absent in the pod namespace
- The secret exists but lacks the referenced key
- The pod references a secret in another namespace, which is not allowed
- A secretKeyRef name or key has a typo
Diagnosis steps
Describe the pod to see the exact error
kubectl describe pod <pod>Interpretation
The events section names the missing secret or key, which is more specific than the container status alone.
Check the secret and its keys
kubectl get secret app-secrets -o jsonpath="{.data}"Interpretation
The keys present in the secret must include the one referenced; a missing key causes the config error even when the secret exists.
Verify namespace
kubectl get secret app-secrets -n <namespace>Interpretation
Secrets are namespace-scoped, so a pod in a different namespace cannot reference one from another.
Root cause
The pod referenced a secret or key that does not exist in its namespace, so kubelet could not build the container environment and the pod stuck in a config error.
Fix
Create the secret in the pod namespace with the required keys, correct the secretKeyRef name and key, or adjust the namespace, then restart the pod.
Verify the fix
Recreate the pod and confirm it starts, and confirm the environment variable or file contains the expected value.
Symptom walkthrough
A pod refuses to start with CreateContainerConfigError, and describing it reveals a missing secret or key. Kubernetes resolves secret references at container start, so a missing key blocks the container before the process runs. Secrets are namespace-scoped, which means a secret that exists elsewhere in the cluster is invisible to a pod in a different namespace.
Fix in practice
Create or correct the secret in the same namespace as the pod with the exact keys referenced, fix typos in the secretKeyRef name or key, and ensure the pod is not assuming a cross-namespace reference. Then recreate the pod so kubelet resolves the reference again.
Verification
Recreate the pod and confirm it starts, then confirm the injected environment variable or mounted file holds the expected value. A running pod with correct configuration confirms the secret wiring.
Diagnostic commands
Check the behavior with commands like these:
kubectl describe pod <pod>
kubectl get secret app-secrets -o jsonpath="{.data}"
kubectl get secret app-secrets -n <namespace>