kubesphere/kubesphere · error

not found valid auth in secret, %v

Error message

not found valid auth in secret, %v

What it means

NewSecretAuthenticator parses a Kubernetes Secret's data field as a Docker config JSON (dockerconfigjson). If the decoded DockerConfigJSON has no entries under the 'auths' map, the secret contains no usable registry credentials, so the authenticator cannot be built and this error is returned. It is thrown by KubeSphere's registry secret authentication layer when a secret is not a well-populated image pull secret.

Source

Thrown at pkg/models/registries/v2/secret_authenticator.go:70

	}

	// force insecure if secret has annotation forceInsecure
	if val, ok := secret.Annotations[forceInsecure]; ok && val == "true" {
		sa.insecure = true
	}

	configJson, ok := secret.Data[v1.DockerConfigJsonKey]
	if !ok {
		return nil, fmt.Errorf("expected key %s in data, found none", v1.DockerConfigJsonKey)
	}

	dockerConfigJSON := DockerConfigJSON{}
	if err := json.Unmarshal(configJson, &dockerConfigJSON); err != nil {
		return nil, err
	}

	if len(dockerConfigJSON.Auths) == 0 {
		return nil, fmt.Errorf("not found valid auth in secret, %v", dockerConfigJSON)
	}

	sa.auths = dockerConfigJSON.Auths

	return sa, nil
}

func (s *secretAuthenticator) Authorization() (*authn.AuthConfig, error) {
	for _, v := range s.auths {
		return &authn.AuthConfig{
			Username: v.Username,
			Password: v.Password,
			Auth:     v.Auth,
		}, nil
	}
	return &authn.AuthConfig{}, nil
}

View on GitHub (pinned to 04a29b5c60)

Solutions

1. Regenerate the pull secret with real credentials: `kubectl create secret docker-registry <name> --docker-server=<registry> --docker-username=<user> --docker-password=<pass>`
2. Verify the secret's .dockerconfigjson data key contains JSON with a non-empty `auths` map: `kubectl get secret <name> -o jsonpath='{.data.\\.dockerconfigjson}' | base64 -d`
3. Ensure the secret type is kubernetes.io/dockerconfigjson and the key is exactly `.dockerconfigjson`, not an arbitrary key
4. If using imagePullSecrets, confirm the secret belongs to the same namespace as the workload

Example fix

// before: secret data
global pull-secret: {"auths":{}}
// after
kubectl create secret docker-registry pull-secret --docker-server=harbor.example.com --docker-username=ci --docker-password=$TOKEN

raw := secret.Data[".dockerconfigjson"]
var cfg DockerConfigJSON
if err := json.Unmarshal(raw, &cfg); err != nil { return err }
if len(cfg.Auths) == 0 {
    return fmt.Errorf("secret %s has empty auths; regenerate with kubectl create secret docker-registry", secret.Name)
}

func hasRegistryAuths(raw []byte) bool {
    var cfg struct { Auths map[string]json.RawMessage `json:"auths"` }
    return json.Unmarshal(raw, &cfg) == nil && len(cfg.Auths) > 0
}

When it happens

Trigger: Creating/patching a Secret of type kubernetes.io/dockerconfigjson (or a raw secret passed to Auth/ListRepositoryTags/TestSecretAuthenticator) where the dockerconfigjson value decodes successfully but its 'auths' object is empty or absent.

Common situations: Creating an image pull secret with an empty auths blob (e.g. `{"auths":{}}` from `docker login` against nothing); a secret generated by a tool that stores credentials elsewhere; copying a secret between clusters where data was stripped; hand-crafting the secret with wrong JSON structure (credentials at top level instead of under auths).

Related errors

• no registry found in secret
• secret %s in ns %s type should be %s
• could not get data %s
• docker config auth len should not be 0
• expected secret type: %s, got: %s

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/8d978f5c4d5d87d3. Report an issue: GitHub.