CreateContainerConfigError Kubernetes Origin: Platform & cloud Last updated 13 Oct 2026

Kubernetes: CreateContainerConfigError — secret / configmap not found

Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namespace.

Exact message you may see secret not foundconfigmap not foundcouldn't find keycontainer has runAsNonRoot and image will run as root
Seen on: Kubernetes

Meaning

Environment variables and volumes from Secrets/ConfigMaps are resolved before the container starts. A missing object or key (or a wrong namespace) stops it here — the app never runs, so there are no app logs.

Common causes

  • Secret/ConfigMap not created (or created in another namespace)
  • Key name typo in secretKeyRef / configMapKeyRef
  • Deployment applied before its secrets in CI
  • runAsNonRoot set but the image runs as root

⚡ Quick fix

  1. kubectl describe pod → Events names the missing object/key
  2. Create it in the same namespace
  3. Use optional: true for truly optional keys
  4. Order manifests so secrets apply first

Detailed fix by platform

Kubernetes

  1. Check and create:
    bash
    kubectl -n prod get secret api-secrets -o jsonpath='{.data}' | head -c 300
    kubectl -n prod create secret generic api-secrets --from-literal=DATABASE_URL='postgres://…'

How to diagnose

  1. Events — Which secret/configmap/key is missing?
  2. Namespace — Same namespace as the pod?
  3. Keys — Exact key names?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

AADSTS7000222 — AADSTS7000222: The provided client secret keys for app are expired (Azure)AADSTS7000222AADSTS90002 — AADSTS90002: Tenant 'x' not found (Azure)AADSTS90002admission webhook denied the request — Error from server: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request (Kubernetes)admission webhook den…AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558api_version_invalid — API Error: Invalid or unsupported API version (API)api_version_invalidAzureWebJobsStorage — Azure Functions: Value cannot be null. (Parameter 'connectionString') / Missing value for AzureWebJobsStorage (Azure)AzureWebJobsStorageBackoffLimitExceeded — Job has reached the specified backoff limit (BackoffLimitExceeded) (Kubernetes)BackoffLimitExceededcannot re-use a name that is still in use — Error: INSTALLATION FAILED: cannot re-use a name that is still in use (Kubernetes)cannot re-use a name …CreateCon…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.