Container Config Secret Discovery Tool

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 10 mins

TL;DR

• What broke: Kubernetes cannot start your container because the pod spec references a Secret object that does not exist in the pod's namespace — the kubelet fails at config materialization before the container ever runs.
• How to fix it: Either create the missing Secret (kubectl create secret) or correct the secret name/namespace reference in your pod spec.
• Use our Client-Side Sandbox above to paste your failing pod YAML and auto-diagnose the broken secretKeyRef, secretRef, or volumes.secret reference.

Warning  Failed     3s    kubelet  Error: CreateContainerConfigError
Message: secret "db-credentials" not found

How to Fix It (The Solution)

Basic Fix — Create the Missing Secret

First, confirm exactly what's missing:

# Check what the pod expects
kubectl get pod <pod-name> -o jsonpath='{.spec.containers[*].env[*].valueFrom.secretKeyRef}'

# Check what exists in the namespace
kubectl get secrets -n <namespace>

Create the secret if it's genuinely absent:

kubectl create secret generic db-credentials \
  --from-literal=DB_PASSWORD='your-password' \
  --from-literal=DB_USER='your-user' \
  -n production

Enterprise Best Practice — Declarative Secret Management with Correct Reference Hygiene

The pod spec was likely referencing a wrong name or the secret was never provisioned by the pipeline. Fix both the reference and the provisioning:

# pod-spec.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: api-server
   namespace: production
 spec:
   template:
     spec:
       containers:
       - name: api
         image: myapp:1.4.2
         env:
-        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: database-creds        # secret didn't exist
-              key: password
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: db-credentials        # matches the actual Secret object name
+              key: DB_PASSWORD
+              optional: false             # explicit — fail fast, don't silently inject empty string

For Vault or AWS Secrets Manager backed secrets, use the External Secrets Operator so the ExternalSecret CR creates the native Kubernetes Secret before any pod references it:

-# Manual kubectl create secret (breaks in GitOps, leaks to shell history)
-kubectl create secret generic db-credentials --from-literal=DB_PASSWORD=$PASS

+# ExternalSecret CR — declarative, auditable, rotation-aware
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: db-credentials
+  namespace: production
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: db-credentials          # this is what the pod references
+    creationPolicy: Owner
+  data:
+  - secretKey: DB_PASSWORD
+    remoteRef:
+      key: secret/production/database
+      property: password

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# In your GitHub Actions / GitLab CI step
kubectl apply --dry-run=server -f k8s/deployment.yaml

# ConstraintTemplate: require referenced secrets to exist before pod admission
violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  ref := container.env[_].valueFrom.secretKeyRef.name
  not data.inventory.namespace[input.review.object.metadata.namespace]["v1"]["Secret"][ref]
  msg := sprintf("Secret '%v' referenced in pod does not exist in namespace '%v'", [ref, input.review.object.metadata.namespace])
}

checkov -f k8s/deployment.yaml --check CKV_K8S_35

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "-1"   # Secrets wave runs first