{"record":{"id":"95b43cc3e94de929","repo":"quarkusio/quarkus","slug":"unable-to-obtain-configuration-for-secret-objects","errorCode":null,"errorMessage":"Unable to obtain configuration for Secret objects from Kubernetes API Server at: \" + client.getConfiguration().getMasterUrl()","messagePattern":"Unable to obtain configuration for Secret objects from Kubernetes API Server at: \" \\+ client\\.getConfiguration\\(\\)\\.getMasterUrl\\(\\)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java","lineNumber":159,"sourceCode":"                if (config.namespace().isPresent()) {\n                    namespace = config.namespace().get();\n                    secret = client.secrets().inNamespace(namespace).withName(secretName).get();\n                } else {\n                    namespace = client.getNamespace();\n                    secret = client.secrets().withName(secretName).get();\n                }\n                if (secret == null) {\n                    logMissingOrFail(secretName, namespace, \"Secret\", config.failOnMissingConfig());\n                } else {\n                    result.addAll(secretConfigSourceUtil.toConfigSources(secret.getMetadata(), secret.getData(), i));\n                    if (log.isDebugEnabled()) {\n                        log.debug(\"Done reading Secret \" + secret.getMetadata().getName());\n                    }\n                }\n            }\n            return result;\n        } catch (Exception e) {\n            throw new RuntimeException(\"Unable to obtain configuration for Secret objects from Kubernetes API Server at: \"\n                    + client.getConfiguration().getMasterUrl(), e);\n        }\n    }\n\n    private void logMissingOrFail(String name, String namespace, String type, boolean failOnMissingConfig) {\n        String message = type + \" '\" + name + \"' not found\";\n        if (namespace == null) {\n            message = message\n                    + \". No Kubernetes namespace was set (most likely because the application is running outside the Kubernetes cluster). Consider setting 'quarkus.kubernetes-client.namespace=my-namespace' to specify the namespace in which to look up the \"\n                    + type;\n        } else {\n            message = message + \" in namespace '\" + namespace + \"'\";\n        }\n        if (failOnMissingConfig) {\n            throw new RuntimeException(message);\n        } else {\n            log.info(message);\n        }","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java#L141-L177","documentation":"Same wrapper as 1100 but in getSecretConfigSources: it rethrows any failure to fetch Secret objects from the Kubernetes API server as a RuntimeException including the API server master URL. Fetching Secrets is more sensitive than ConfigMaps, so RBAC denials are especially common. The actual failure reason is the wrapped cause.","triggerScenarios":"App with quarkus.kubernetes-config.secrets enabled: client.secrets() load/lookup throws during startup — API server unreachable, 403 (no RBAC on secrets), expired/missing token, TLS trust failure, or bad namespace.","commonSituations":"Service account without 'get secrets' permission (very common — clusters deny secrets by default); running locally with no kubeconfig; token mounted but namespace missing; API server URL typo.","solutions":["Check the wrapped cause to identify auth vs connectivity vs RBAC.","Grant the service account RBAC get on secrets in the target namespace (ClusterRole + RoleBinding).","Verify quarkus.kubernetes-client.namespace and master URL / token configuration.","Confirm network reachability and CA trust to the API server (quarkus.kubernetes-client.trust-certs / CA config).","If the secrets are not actually needed, disable quarkus.kubernetes-config.secrets.enabled."],"exampleFix":"# before\nquarkus.kubernetes-config.secrets.enabled=true\n# after: add RBAC\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n  namespace: my-namespace\n  name: secret-reader\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    verbs: [\"get\", \"list\"]","handlingStrategy":"validation","validationCode":"kubectl auth can-i get secrets --namespace=my-namespace --as=system:serviceaccount:my-namespace:my-sa","typeGuard":null,"tryCatchPattern":"try {\n    app.start();\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Unable to obtain configuration for Secret\")) {\n        log.error(\"Secret fetch failed — check RBAC on secrets and client config\", e.getCause());\n    }\n}","preventionTips":["Pre-verify with `kubectl auth can-i get secrets` as the pod's service account.","Never assume secrets access — clusters deny it by default for most SAs.","Test config-source loading locally against the real cluster before deploy.","Pin quarkus.kubernetes-config.namespaces and namespace to the same value."],"tags":["kubernetes","config-source","secrets","rbac","startup"],"backgroundTag":"kubernetes-api-server-unreachable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}