quarkusio/quarkus · critical · RuntimeException

Unable to obtain configuration for ConfigMap objects from Ku

Error message

Unable to obtain configuration for ConfigMap objects from Kubernetes API Server at: " + client.getConfiguration().getMasterUrl()

What it means

KubernetesConfigSourceFactory.getConfigMapConfigSources wraps its entire ConfigMap lookup in a catch-all that rethrows as RuntimeException when any error occurs while fetching ConfigMaps from the Kubernetes API server. The message includes the API server master URL to identify which cluster was being contacted. It is a generic wrapper: the real cause (auth failure, connectivity, RBAC, serialization) is in the cause chain.

Source

Thrown at extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java:125

                if (config.namespace().isPresent()) {
                    namespace = config.namespace().get();
                    configMap = client.configMaps().inNamespace(namespace).withName(configMapName).get();
                } else {
                    namespace = client.getNamespace();
                    configMap = client.configMaps().withName(configMapName).get();
                }
                if (configMap == null) {
                    logMissingOrFail(configMapName, namespace, "ConfigMap", config.failOnMissingConfig());
                } else {
                    result.addAll(configMapConfigSourceUtil.toConfigSources(configMap.getMetadata(), configMap.getData(), i));
                    if (log.isDebugEnabled()) {
                        log.debug("Done reading ConfigMap " + configMap.getMetadata().getName());
                    }
                }
            }
            return result;
        } catch (Exception e) {
            throw new RuntimeException("Unable to obtain configuration for ConfigMap objects from Kubernetes API Server at: "
                    + client.getConfiguration().getMasterUrl(), e);
        }
    }

    private List<ConfigSource> getSecretConfigSources(List<String> secretNames, KubernetesConfigSourceConfig config) {
        List<ConfigSource> result = new ArrayList<>(secretNames.size());

        try {
            for (int i = 0; i < secretNames.size(); i++) {
                String secretName = secretNames.get(i);
                if (log.isDebugEnabled()) {
                    log.debug("Attempting to read Secret " + secretName);
                }
                Secret secret;
                String namespace;
                if (config.namespace().isPresent()) {
                    namespace = config.namespace().get();
                    secret = client.secrets().inNamespace(namespace).withName(secretName).get();

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the 'Caused by' of this exception to find the root cause (connectivity, auth, RBAC, TLS).
Verify quarkus.kubernetes-client settings (master URL, token, trust certs, namespace) against your cluster.
Confirm the service account has RBAC permission to get configmaps in the target namespace.
If running outside the cluster, point the client at a valid kubeconfig or set quarkus.kubernetes-client.namespace explicitly.
Test API server reachability: curl the master URL shown in the message with the pod's token.

Example fix

// before: missing namespace/RBAC context
quarkus.kubernetes-config.config-maps=my-cm
// after
quarkus.kubernetes-config.config-maps=my-cm
quarkus.kubernetes-config.namespaces=my-namespace
quarkus.kubernetes-client.namespace=my-namespace
# plus ClusterRole granting get on configmaps

Defensive patterns

Strategy: validation

Validate before calling

// Before relying on k8s config sources, verify cluster access:
try (KubernetesClient c = new KubernetesClientBuilder().build()) {
    String ns = System.getProperty("namespace", c.getNamespace());
    c.configMaps().inNamespace(ns).list(); // fails fast with a clear error
}

Try / catch

try {
    app.start();
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Unable to obtain configuration for ConfigMap")) {
        log.error("K8s API server unreachable or RBAC denied (see cause)", e.getCause());
    }
}

Prevention

Set quarkus.kubernetes-client.namespace explicitly for out-of-cluster runs.
Grant the service account RBAC get/list on configmaps before deploying.
Smoke-test API server connectivity from inside the pod with curl + the SA token.
Keep a startup healthcheck that surfaces the wrapped cause, not just the message.

When it happens

Trigger: Startup of an app with quarkus.kubernetes-config.config-maps enabled: the Kubernetes client (configured via quarkus.kubernetes-client.*) fails during client.configMaps() load/lookup in getConfigMapConfigSources — e.g. API server unreachable, 401/403 from bad credentials or missing RBAC permissions on configmaps, invalid namespace, or TLS errors.

Common situations: App configured to read ConfigMaps as config sources but running outside the cluster without kubeconfig; service account lacking get/list permission on configmaps; wrong quarkus.kubernetes-client.api-server-url or expired token; proxy/firewall blocking the API server.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8d119df5d0c9e176. Report an issue: GitHub.