highFoundationSymptom-first#secrets#volumes#mounting#pods

MountVolume.SetUp failed — secret not found, pod can't start

Pod stuck in CreateContainerConfigError or CrashLoopBackOff with mount error

Likely source:availabilityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Pod stuck in CreateContainerConfigError or CrashLoopBackOff with mount error
  • Events show MountVolume.SetUp failed for secret "<name>"
  • Pod never reaches Running state after deploy

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Mount error in events

    kubectl describe pod <pod> -n <namespace> | grep -A5 Events

  • Secret existence check

    kubectl get secret <secret> -n <namespace>

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • kubectl get secret <secret> -n <namespace> returns NotFound
  • Events: MountVolume.SetUp failed: secret not found

Confirm before fixing

kubectl get secret <secret> -n <namespace>
READ

Confirm the secret is missing

Expected: Error from server (NotFound)

Fix

kubectl create secret generic <secret> --from-literal=key=value -n <namespace>
CHANGE

Create the missing secret in the correct namespace

Expected: secret/<secret> created

kubectl rollout restart deployment/<deploy> -n <namespace>
CHANGE

Restart so the pod picks up the new secret

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
kubectl describe pod <pod> -n <namespace> | grep -A10 Events
READ

Read the mount error

2
kubectl get secret <secret> -n <namespace>
READ

Check if the secret exists

3
kubectl create secret generic <secret> --from-literal=key=value -n <namespace>
CHANGE

Create the missing secret

4
kubectl rollout restart deployment/<deploy> -n <namespace>
CHANGE

Restart the deployment to mount the new secret

5
kubectl rollout status deployment/<deploy> -n <namespace>
READ

Verify the rollout completes

Prevention

  • Include secret creation in the deployment pipeline or Helm post-install hooks.
  • Use external secret managers (Vault, AWS Secrets Manager) with CSI or operator sync.
  • Validate secret references in manifests with kubectl dry-run --validate.
  • Add a pre-deploy check: kubectl get secret <name> -n <ns> must succeed.

Related runbooks

Same stack, same failure family — worth a skim.

ConfigMap not found — pod can't start, volume mount or env failshigh

Pod stuck in CreateContainerConfigError or CrashLoopBackOff

KubernetesFoundation3 causes
Open runbook
CrashLoopBackOff — container keeps crashing and restartingcritical

kubectl get pods shows CrashLoopBackOff status

KubernetesFoundation4 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.