{"record":{"id":"8d978f5c4d5d87d3","repo":"kubesphere/kubesphere","slug":"not-found-valid-auth-in-secret-v","errorCode":null,"errorMessage":"not found valid auth in secret, %v","messagePattern":"not found valid auth in secret, (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/models/registries/v2/secret_authenticator.go","lineNumber":70,"sourceCode":"\t}\n\n\t// force insecure if secret has annotation forceInsecure\n\tif val, ok := secret.Annotations[forceInsecure]; ok && val == \"true\" {\n\t\tsa.insecure = true\n\t}\n\n\tconfigJson, ok := secret.Data[v1.DockerConfigJsonKey]\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"expected key %s in data, found none\", v1.DockerConfigJsonKey)\n\t}\n\n\tdockerConfigJSON := DockerConfigJSON{}\n\tif err := json.Unmarshal(configJson, &dockerConfigJSON); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif len(dockerConfigJSON.Auths) == 0 {\n\t\treturn nil, fmt.Errorf(\"not found valid auth in secret, %v\", dockerConfigJSON)\n\t}\n\n\tsa.auths = dockerConfigJSON.Auths\n\n\treturn sa, nil\n}\n\nfunc (s *secretAuthenticator) Authorization() (*authn.AuthConfig, error) {\n\tfor _, v := range s.auths {\n\t\treturn &authn.AuthConfig{\n\t\t\tUsername: v.Username,\n\t\t\tPassword: v.Password,\n\t\t\tAuth:     v.Auth,\n\t\t}, nil\n\t}\n\treturn &authn.AuthConfig{}, nil\n}\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/models/registries/v2/secret_authenticator.go#L52-L88","documentation":"NewSecretAuthenticator parses a Kubernetes Secret's data field as a Docker config JSON (dockerconfigjson). If the decoded DockerConfigJSON has no entries under the 'auths' map, the secret contains no usable registry credentials, so the authenticator cannot be built and this error is returned. It is thrown by KubeSphere's registry secret authentication layer when a secret is not a well-populated image pull secret.","triggerScenarios":"Creating/patching a Secret of type kubernetes.io/dockerconfigjson (or a raw secret passed to Auth/ListRepositoryTags/TestSecretAuthenticator) where the dockerconfigjson value decodes successfully but its 'auths' object is empty or absent.","commonSituations":"Creating an image pull secret with an empty auths blob (e.g. `{\"auths\":{}}` from `docker login` against nothing); a secret generated by a tool that stores credentials elsewhere; copying a secret between clusters where data was stripped; hand-crafting the secret with wrong JSON structure (credentials at top level instead of under auths).","solutions":["Regenerate the pull secret with real credentials: `kubectl create secret docker-registry <name> --docker-server=<registry> --docker-username=<user> --docker-password=<pass>`","Verify the secret's .dockerconfigjson data key contains JSON with a non-empty `auths` map: `kubectl get secret <name> -o jsonpath='{.data.\\\\.dockerconfigjson}' | base64 -d`","Ensure the secret type is kubernetes.io/dockerconfigjson and the key is exactly `.dockerconfigjson`, not an arbitrary key","If using imagePullSecrets, confirm the secret belongs to the same namespace as the workload"],"exampleFix":"// before: secret data\nglobal pull-secret: {\"auths\":{}}\n// after\nkubectl create secret docker-registry pull-secret --docker-server=harbor.example.com --docker-username=ci --docker-password=$TOKEN","handlingStrategy":"validation","validationCode":"raw := secret.Data[\".dockerconfigjson\"]\nvar cfg DockerConfigJSON\nif err := json.Unmarshal(raw, &cfg); err != nil { return err }\nif len(cfg.Auths) == 0 {\n    return fmt.Errorf(\"secret %s has empty auths; regenerate with kubectl create secret docker-registry\", secret.Name)\n}","typeGuard":"func hasRegistryAuths(raw []byte) bool {\n    var cfg struct { Auths map[string]json.RawMessage `json:\"auths\"` }\n    return json.Unmarshal(raw, &cfg) == nil && len(cfg.Auths) > 0\n}","tryCatchPattern":null,"preventionTips":["Always create pull secrets via kubectl create secret docker-registry","Verify secret data with base64 -d before applying","Keep the key name exactly .dockerconfigjson","Validate JSON structure in CI when secrets are generated by pipelines"],"tags":["kubernetes","docker-registry","secret","auth"],"backgroundTag":null,"analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}