What causes "failed to fetch secret %q: missing password key" in cilium/cilium?

Add a 'password' key with a non-empty value to the referenced Secret's data map

failed to fetch secret %q: missing password key

Error message

failed to fetch secret %q: missing password key

What it means

getPeerPassword reads a Kubernetes Secret (via the SecretStore) to obtain a BGP TCP MD5 password for a peer. If the secret data exists but has no 'password' key, or the value is empty, it returns this error. It means the referenced secret is present but does not contain the expected key/value.

Source

Thrown at pkg/bgp/manager/reconciler/neighbor.go:339

func (r *NeighborReconciler) getPeerPassword(instanceName, peerName string, config *v2.CiliumBGPPeerConfigSpec) (string, error) {
	if config == nil {
		return "", nil
	}

	if config.AuthSecretRef != nil {
		secretRef := *config.AuthSecretRef

		secret, ok, err := r.fetchSecret(secretRef)
		if err != nil {
			return "", fmt.Errorf("failed to fetch secret %q: %w", secretRef, err)
		}
		if !ok {
			return "", nil
		}
		tcpPassword := string(secret["password"])
		if tcpPassword == "" {
			return "", fmt.Errorf("failed to fetch secret %q: missing password key", secretRef)
		}
		r.logger.Debug(
			"Using TCP password from secret",
			types.SecretRefLogField, secretRef,
			types.InstanceLogField, instanceName,
			types.PeerLogField, peerName,
		)
		return tcpPassword, nil
	}
	return "", nil
}

func (r *NeighborReconciler) fetchSecret(name string) (map[string][]byte, bool, error) {
	if r.SecretStore == nil {
		return nil, false, fmt.Errorf("SecretsNamespace not configured")
	}
	item, ok, err := r.SecretStore.GetByKey(resource.Key{Namespace: r.BGPConfig.SecretsNamespace, Name: name})
	if err != nil || !ok {

View on GitHub (pinned to ac7b90affa)

Solutions

Add a 'password' key with a non-empty value to the referenced Secret's data map
Verify the peer's secretRef name points to the intended Secret (kubectl get secret <name> -o jsonpath='{.data}')
Recreate/patch the Secret: kubectl patch secret <name> -p '{"stringData":{"password":"<value>"}}'
Check for typos in the key name — the lookup is exactly 'password'

Example fix

// before: secret with wrong key
apiVersion: v1
kind: Secret
data:
  tcpPassword: <base64>
// after
apiVersion: v1
kind: Secret
stringData:
  password: myTcpPassword

Defensive patterns

Strategy: validation

Validate before calling

import "k8s.io/apimachinery/pkg/util/validation"
s := corev1.Secret{}
if _, ok := s.Data["password"]; !ok || len(s.Data["password"]) == 0 {
    return errors.New("secret must contain a non-empty 'password' key")
}

Type guard

func hasPassword(s *corev1.Secret) bool {
    pw, ok := s.Data["password"]
    return ok && len(pw) > 0
}

Try / catch

pw, err := getPeerPassword(ctx, secretRef)
if err != nil {
    if strings.Contains(err.Error(), "missing password key") {
        return fmt.Errorf("secret %s lacks 'password' key; fix the secret", secretRef)
    }
    return err
}

Prevention

Always create BGP TCP secrets with the exact key 'password'
Use stringData in YAML so values are human-checkable before base64
Add a CI lint that asserts every secretRef target contains the 'password' key
Name secrets consistently, e.g. bgp-tcp-password-<peer>, and validate with kustomize/Kyverno policies

When it happens

Trigger: A CiliumBGPNeighbor references a SecretRef whose Secret exists in the namespace but its data map lacks a 'password' key, or the 'password' key holds an empty string value.

Common situations: Secret created with a different key name (e.g. 'tcpPassword', 'secret'); secret created by a tool writing keys in another format; password field accidentally blanked during an update; wrong secretRef pointing to a similarly named secret.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/cd0c2b08535f88c4. Report an issue: GitHub.