Tekton "CreateContainerConfigError" (missing Secret key) in CI

By Daniel Zoghalchali·Latchkey

The kubelet could not build the container config for a step because an env var or volume references a ConfigMap or Secret (or a key within it) that does not exist. The step stays Waiting with reason CreateContainerConfigError.

What this error means

A TaskRun pod is Pending; describe shows "Error: couldn't find key TOKEN in Secret ci/build-creds" and reason CreateContainerConfigError.

Error: couldn't find key TOKEN in Secret ci/build-creds
  Warning  Failed  CreateContainerConfigError

Common causes

A referenced Secret or ConfigMap key is absent

A step env uses valueFrom.secretKeyRef (or configMapKeyRef) naming a key that the object does not contain.

The Secret or ConfigMap does not exist in the namespace

The referenced object was never applied to the run namespace, so the kubelet cannot resolve it.

How to fix it

Create the key the step references

1. Read the exact object and key from the describe output.
2. Create or update the Secret/ConfigMap so the key exists.
3. Re-run the TaskRun.

kubectl create secret generic build-creds \
  --from-literal=TOKEN=$TOKEN -n ci

Match the key name in the ref

Ensure the key in the env ref matches a key that actually exists in the object.

env:
  - name: TOKEN
    valueFrom:
      secretKeyRef:
        name: build-creds
        key: TOKEN

How to prevent it

• Apply referenced Secrets and ConfigMaps into the run namespace first.
• Keep env ref key names matched to the object keys.
• Validate manifests in CI so missing refs surface before a run.

Frequently asked questions

Related guides

References

• Kubernetes documentation
• GitHub Actions documentation