quarkusio/quarkus · critical · RuntimeException

Unable to obtain configuration for Secret objects from Kuber

Error message

Unable to obtain configuration for Secret objects from Kubernetes API Server at: " + client.getConfiguration().getMasterUrl()

What it means

Same wrapper as 1100 but in getSecretConfigSources: it rethrows any failure to fetch Secret objects from the Kubernetes API server as a RuntimeException including the API server master URL. Fetching Secrets is more sensitive than ConfigMaps, so RBAC denials are especially common. The actual failure reason is the wrapped cause.

Source

Thrown at extensions/kubernetes-config/runtime/src/main/java/io/quarkus/kubernetes/config/runtime/KubernetesConfigSourceFactory.java:159

                if (config.namespace().isPresent()) {
                    namespace = config.namespace().get();
                    secret = client.secrets().inNamespace(namespace).withName(secretName).get();
                } else {
                    namespace = client.getNamespace();
                    secret = client.secrets().withName(secretName).get();
                }
                if (secret == null) {
                    logMissingOrFail(secretName, namespace, "Secret", config.failOnMissingConfig());
                } else {
                    result.addAll(secretConfigSourceUtil.toConfigSources(secret.getMetadata(), secret.getData(), i));
                    if (log.isDebugEnabled()) {
                        log.debug("Done reading Secret " + secret.getMetadata().getName());
                    }
                }
            }
            return result;
        } catch (Exception e) {
            throw new RuntimeException("Unable to obtain configuration for Secret objects from Kubernetes API Server at: "
                    + client.getConfiguration().getMasterUrl(), e);
        }
    }

    private void logMissingOrFail(String name, String namespace, String type, boolean failOnMissingConfig) {
        String message = type + " '" + name + "' not found";
        if (namespace == null) {
            message = message
                    + ". No Kubernetes namespace was set (most likely because the application is running outside the Kubernetes cluster). Consider setting 'quarkus.kubernetes-client.namespace=my-namespace' to specify the namespace in which to look up the "
                    + type;
        } else {
            message = message + " in namespace '" + namespace + "'";
        }
        if (failOnMissingConfig) {
            throw new RuntimeException(message);
        } else {
            log.info(message);
        }

View on GitHub (pinned to e1c734241f)

Solutions

Check the wrapped cause to identify auth vs connectivity vs RBAC.
Grant the service account RBAC get on secrets in the target namespace (ClusterRole + RoleBinding).
Verify quarkus.kubernetes-client.namespace and master URL / token configuration.
Confirm network reachability and CA trust to the API server (quarkus.kubernetes-client.trust-certs / CA config).
If the secrets are not actually needed, disable quarkus.kubernetes-config.secrets.enabled.

Example fix

# before
quarkus.kubernetes-config.secrets.enabled=true
# after: add RBAC
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: my-namespace
  name: secret-reader
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]

Defensive patterns

Strategy: validation

Validate before calling

kubectl auth can-i get secrets --namespace=my-namespace --as=system:serviceaccount:my-namespace:my-sa

Try / catch

try {
    app.start();
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Unable to obtain configuration for Secret")) {
        log.error("Secret fetch failed — check RBAC on secrets and client config", e.getCause());
    }
}

Prevention

Pre-verify with `kubectl auth can-i get secrets` as the pod's service account.
Never assume secrets access — clusters deny it by default for most SAs.
Test config-source loading locally against the real cluster before deploy.
Pin quarkus.kubernetes-config.namespaces and namespace to the same value.

When it happens

Trigger: App with quarkus.kubernetes-config.secrets enabled: client.secrets() load/lookup throws during startup — API server unreachable, 403 (no RBAC on secrets), expired/missing token, TLS trust failure, or bad namespace.

Common situations: Service account without 'get secrets' permission (very common — clusters deny secrets by default); running locally with no kubeconfig; token mounted but namespace missing; API server URL typo.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/95b43cc3e94de929. Report an issue: GitHub.