Flux Receiver webhook "token not found" / not triggering in CI

By Kaveh Alemi·Latchkey

A Flux Receiver exposes a webhook that notification-controller uses to trigger reconciles on git events. If the token secret is missing or the incoming signature does not match, the webhook is rejected and no reconcile fires.

What this error means

A Receiver reports "False" with "unable to read token" or "token not found", or the webhook returns an error, so pushes do not trigger an immediate reconcile.

unable to read token from secret 'flux-system/receiver-token': secret "receiver-token" not found

Common causes

The token secret is missing

The Receiver references a spec.secretRef token secret that does not exist, so notification-controller cannot verify incoming requests.

The webhook signature does not match

The provider sends a signature computed with a different token than the one in the secret, so the request is rejected.

How to fix it

Create the token secret and match it upstream

1. Create the token secret the Receiver references.
2. Configure the git provider webhook with the same token and the Receiver URL.
3. Reconcile and confirm the Receiver becomes Ready.

kubectl -n flux-system create secret generic receiver-token \
  --from-literal=token=$WEBHOOK_TOKEN
kubectl -n flux-system describe receiver github

Fall back to interval reconciliation

While the webhook is fixed, Flux still reconciles on its interval; the Receiver only makes it immediate.

flux reconcile source git infra --with-source

How to prevent it

• Create the Receiver token secret before wiring the provider webhook.
• Use the same token in the provider and the secret.
• Rely on reconcile intervals as a backstop when webhooks are down.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation