{"record":{"id":"8d119df5d0c9e176","repo":"quarkusio/quarkus","slug":"unable-to-obtain-configuration-for-configmap-objec","errorCode":null,"errorMessage":"Unable to obtain configuration for ConfigMap objects from Kubernetes API Server at: \" + client.getConfiguration().getMasterUrl()","messagePattern":"Unable to obtain configuration for ConfigMap objects from Kubernetes API Server at: \" \\+ client\\.getConfiguration\\(\\)\\.getMasterUrl\\(\\)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java","lineNumber":125,"sourceCode":"                if (config.namespace().isPresent()) {\n                    namespace = config.namespace().get();\n                    configMap = client.configMaps().inNamespace(namespace).withName(configMapName).get();\n                } else {\n                    namespace = client.getNamespace();\n                    configMap = client.configMaps().withName(configMapName).get();\n                }\n                if (configMap == null) {\n                    logMissingOrFail(configMapName, namespace, \"ConfigMap\", config.failOnMissingConfig());\n                } else {\n                    result.addAll(configMapConfigSourceUtil.toConfigSources(configMap.getMetadata(), configMap.getData(), i));\n                    if (log.isDebugEnabled()) {\n                        log.debug(\"Done reading ConfigMap \" + configMap.getMetadata().getName());\n                    }\n                }\n            }\n            return result;\n        } catch (Exception e) {\n            throw new RuntimeException(\"Unable to obtain configuration for ConfigMap objects from Kubernetes API Server at: \"\n                    + client.getConfiguration().getMasterUrl(), e);\n        }\n    }\n\n    private List<ConfigSource> getSecretConfigSources(List<String> secretNames, KubernetesConfigSourceConfig config) {\n        List<ConfigSource> result = new ArrayList<>(secretNames.size());\n\n        try {\n            for (int i = 0; i < secretNames.size(); i++) {\n                String secretName = secretNames.get(i);\n                if (log.isDebugEnabled()) {\n                    log.debug(\"Attempting to read Secret \" + secretName);\n                }\n                Secret secret;\n                String namespace;\n                if (config.namespace().isPresent()) {\n                    namespace = config.namespace().get();\n                    secret = client.secrets().inNamespace(namespace).withName(secretName).get();","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java#L107-L143","documentation":"KubernetesConfigSourceFactory.getConfigMapConfigSources wraps its entire ConfigMap lookup in a catch-all that rethrows as RuntimeException when any error occurs while fetching ConfigMaps from the Kubernetes API server. The message includes the API server master URL to identify which cluster was being contacted. It is a generic wrapper: the real cause (auth failure, connectivity, RBAC, serialization) is in the cause chain.","triggerScenarios":"Startup of an app with quarkus.kubernetes-config.config-maps enabled: the Kubernetes client (configured via quarkus.kubernetes-client.*) fails during client.configMaps() load/lookup in getConfigMapConfigSources — e.g. API server unreachable, 401/403 from bad credentials or missing RBAC permissions on configmaps, invalid namespace, or TLS errors.","commonSituations":"App configured to read ConfigMaps as config sources but running outside the cluster without kubeconfig; service account lacking get/list permission on configmaps; wrong quarkus.kubernetes-client.api-server-url or expired token; proxy/firewall blocking the API server.","solutions":["Inspect the 'Caused by' of this exception to find the root cause (connectivity, auth, RBAC, TLS).","Verify quarkus.kubernetes-client settings (master URL, token, trust certs, namespace) against your cluster.","Confirm the service account has RBAC permission to get configmaps in the target namespace.","If running outside the cluster, point the client at a valid kubeconfig or set quarkus.kubernetes-client.namespace explicitly.","Test API server reachability: curl the master URL shown in the message with the pod's token."],"exampleFix":"// before: missing namespace/RBAC context\nquarkus.kubernetes-config.config-maps=my-cm\n// after\nquarkus.kubernetes-config.config-maps=my-cm\nquarkus.kubernetes-config.namespaces=my-namespace\nquarkus.kubernetes-client.namespace=my-namespace\n# plus ClusterRole granting get on configmaps","handlingStrategy":"validation","validationCode":"// Before relying on k8s config sources, verify cluster access:\ntry (KubernetesClient c = new KubernetesClientBuilder().build()) {\n    String ns = System.getProperty(\"namespace\", c.getNamespace());\n    c.configMaps().inNamespace(ns).list(); // fails fast with a clear error\n}","typeGuard":null,"tryCatchPattern":"try {\n    app.start();\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Unable to obtain configuration for ConfigMap\")) {\n        log.error(\"K8s API server unreachable or RBAC denied (see cause)\", e.getCause());\n    }\n}","preventionTips":["Set quarkus.kubernetes-client.namespace explicitly for out-of-cluster runs.","Grant the service account RBAC get/list on configmaps before deploying.","Smoke-test API server connectivity from inside the pod with curl + the SA token.","Keep a startup healthcheck that surfaces the wrapped cause, not just the message."],"tags":["kubernetes","config-source","api-server","startup"],"backgroundTag":"kubernetes-api-server-unreachable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}