{"record":{"id":"cd0c2b08535f88c4","repo":"cilium/cilium","slug":"failed-to-fetch-secret-q-missing-password-key","errorCode":null,"errorMessage":"failed to fetch secret %q: missing password key","messagePattern":"failed to fetch secret %q: missing password key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bgp/manager/reconciler/neighbor.go","lineNumber":339,"sourceCode":"\nfunc (r *NeighborReconciler) getPeerPassword(instanceName, peerName string, config *v2.CiliumBGPPeerConfigSpec) (string, error) {\n\tif config == nil {\n\t\treturn \"\", nil\n\t}\n\n\tif config.AuthSecretRef != nil {\n\t\tsecretRef := *config.AuthSecretRef\n\n\t\tsecret, ok, err := r.fetchSecret(secretRef)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to fetch secret %q: %w\", secretRef, err)\n\t\t}\n\t\tif !ok {\n\t\t\treturn \"\", nil\n\t\t}\n\t\ttcpPassword := string(secret[\"password\"])\n\t\tif tcpPassword == \"\" {\n\t\t\treturn \"\", fmt.Errorf(\"failed to fetch secret %q: missing password key\", secretRef)\n\t\t}\n\t\tr.logger.Debug(\n\t\t\t\"Using TCP password from secret\",\n\t\t\ttypes.SecretRefLogField, secretRef,\n\t\t\ttypes.InstanceLogField, instanceName,\n\t\t\ttypes.PeerLogField, peerName,\n\t\t)\n\t\treturn tcpPassword, nil\n\t}\n\treturn \"\", nil\n}\n\nfunc (r *NeighborReconciler) fetchSecret(name string) (map[string][]byte, bool, error) {\n\tif r.SecretStore == nil {\n\t\treturn nil, false, fmt.Errorf(\"SecretsNamespace not configured\")\n\t}\n\titem, ok, err := r.SecretStore.GetByKey(resource.Key{Namespace: r.BGPConfig.SecretsNamespace, Name: name})\n\tif err != nil || !ok {","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/bgp/manager/reconciler/neighbor.go#L321-L357","documentation":"getPeerPassword reads a Kubernetes Secret (via the SecretStore) to obtain a BGP TCP MD5 password for a peer. If the secret data exists but has no 'password' key, or the value is empty, it returns this error. It means the referenced secret is present but does not contain the expected key/value.","triggerScenarios":"A CiliumBGPNeighbor references a SecretRef whose Secret exists in the namespace but its data map lacks a 'password' key, or the 'password' key holds an empty string value.","commonSituations":"Secret created with a different key name (e.g. 'tcpPassword', 'secret'); secret created by a tool writing keys in another format; password field accidentally blanked during an update; wrong secretRef pointing to a similarly named secret.","solutions":["Add a 'password' key with a non-empty value to the referenced Secret's data map","Verify the peer's secretRef name points to the intended Secret (kubectl get secret <name> -o jsonpath='{.data}')","Recreate/patch the Secret: kubectl patch secret <name> -p '{\"stringData\":{\"password\":\"<value>\"}}'","Check for typos in the key name — the lookup is exactly 'password'"],"exampleFix":"// before: secret with wrong key\napiVersion: v1\nkind: Secret\ndata:\n  tcpPassword: <base64>\n// after\napiVersion: v1\nkind: Secret\nstringData:\n  password: myTcpPassword","handlingStrategy":"validation","validationCode":"import \"k8s.io/apimachinery/pkg/util/validation\"\ns := corev1.Secret{}\nif _, ok := s.Data[\"password\"]; !ok || len(s.Data[\"password\"]) == 0 {\n    return errors.New(\"secret must contain a non-empty 'password' key\")\n}","typeGuard":"func hasPassword(s *corev1.Secret) bool {\n    pw, ok := s.Data[\"password\"]\n    return ok && len(pw) > 0\n}","tryCatchPattern":"pw, err := getPeerPassword(ctx, secretRef)\nif err != nil {\n    if strings.Contains(err.Error(), \"missing password key\") {\n        return fmt.Errorf(\"secret %s lacks 'password' key; fix the secret\", secretRef)\n    }\n    return err\n}","preventionTips":["Always create BGP TCP secrets with the exact key 'password'","Use stringData in YAML so values are human-checkable before base64","Add a CI lint that asserts every secretRef target contains the 'password' key","Name secrets consistently, e.g. bgp-tcp-password-<peer>, and validate with kustomize/Kyverno policies"],"tags":["kubernetes","bgp","secret","config"],"backgroundTag":"missing-secret-key","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}