Kubernetes "CreateContainerConfigError" (missing Secret/ConfigMap) in CI - Fix it

CreateContainerConfigError means scheduling succeeded but the kubelet could not assemble the container: an envFrom, valueFrom, or volume points at a Secret/ConfigMap (or a key inside one) that does not exist in the namespace. The deploy applied before its config did.

What this error means

kubectl get pods shows CreateContainerConfigError, and kubectl describe pod reports secret "api-secrets" not found or couldn't find key DATABASE_URL in Secret "prod/api-secrets".

Warning  Failed  kubelet  Error: couldn't find key DATABASE_URL in Secret
"prod/api-secrets"

Common causes

The Secret/ConfigMap is missing or in another namespace

The referenced object was never created in this namespace, or it landed in a different one than the pod.

A referenced key is absent or misspelled

The Secret/ConfigMap exists but the specific key the env var maps to is missing or wrong.

How to fix it

Create the config before (or with) the workload

1. Read kubectl describe pod to see which Secret/ConfigMap or key is missing.
2. Apply the Secret/ConfigMap in the same namespace before the Deployment.
3. Confirm the referenced keys exist with the exact names the pod uses.

kubectl get secret api-secrets -n prod -o jsonpath='{.data.DATABASE_URL}'

Order config ahead of the Deployment

Apply Secrets and ConfigMaps first so the workload finds them when it starts.

kubectl apply -f secrets.yaml -f configmap.yaml -n prod
kubectl apply -f deployment.yaml -n prod

How to prevent it

• Apply Secrets/ConfigMaps before the workloads that consume them.
• Deploy config and workloads into the same namespace.
• Validate referenced keys exist before rolling out.

Related guides