Stop Kubernetes CreateContainerConfigError Nightmares 2025

# Create a comprehensive pre-deployment validation script
#!/bin/bash
echo "🔍 Validating Kubernetes manifests..."

# Check YAML syntax
kubectl apply --dry-run=client -f manifests/ --recursive

# Check if referenced resources exist
echo "📋 Checking ConfigMaps..."
grep -r "configMapRef\|configMapKeyRef" manifests/ | \
  grep -o "name: [^[:space:]]*" | \
  cut -d' ' -f2 | sort -u | \
  while read cm; do
    kubectl get configmap "$cm" >/dev/null 2>&1 && \
    echo "✅ ConfigMap $cm exists" || \
    echo "❌ ConfigMap $cm missing"
  done

echo "🔐 Checking Secrets..."
grep -r "secretKeyRef\|secretRef" manifests/ | \
  grep -o "name: [^[:space:]]*" | \
  cut -d' ' -f2 | sort -u | \
  while read secret; do
    kubectl get secret "$secret" >/dev/null 2>&1 && \
    echo "✅ Secret $secret exists" || \
    echo "❌ Secret $secret missing"
  done

echo "✅ Validation complete!"

# Store ConfigMaps in version control (secrets should be handled differently)
cat > k8s/configmap.yaml <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
  labels:
    app: web-app
    version: "1.2.0"
data:
  # Application configuration
  DATABASE_URL: "postgres://prod-db:5432/app"
  LOG_LEVEL: "INFO"
  API_TIMEOUT: "30s"
  
  # Configuration files
  app.properties: |
    server.port=8080
    management.endpoints.web.exposure.include=# How to Fix CreateContainerConfigError in Kubernetes: A Complete DevOps Guide

**SEO Meta Title:** Fix CreateContainerConfigError in Kubernetes | Complete DevOps Troubleshooting Guide
**SEO Meta Description:** Learn to debug and fix CreateContainerConfigError in Kubernetes. Step-by-step guide covering ConfigMaps, Secrets, volume mounts, and YAML validation for DevOps engineers.
**SEO Slug:** kubernetes-createcontainerconfigerror-fix-guide

## The DevOps Nightmare: When Your Deployment Goes Wrong

Picture this: It's Monday morning, and you've just deployed a critical application update to your Kubernetes cluster. Coffee in hand, you run `kubectl get pods` expecting to see your pods in Running status, but instead, you're greeted with the dreaded `CreateContainerConfigError`.

Your heart sinks as you realize the application isn't starting, and users might be affected. This scenario is all too familiar for DevOps engineers working with Kubernetes, but the good news is that **CreateContainerConfigError** is one of the most solvable Kubernetes errors once you understand the systematic approach to debugging it.

## What is CreateContainerConfigError in Kubernetes?

**CreateContainerConfigError** is a Kubernetes pod status that indicates the kubelet cannot create a container due to invalid or missing configuration. Unlike other pod errors such as `ImagePullBackOff` or `CrashLoopBackOff`, this error occurs before the container even attempts to start.

When you see a **pod CreateContainerConfigError**, it means:
- Kubernetes successfully scheduled the pod to a node
- The kubelet is ready to create the container
- However, the container configuration contains errors or references missing resources

This error is particularly common when working with ConfigMaps, Secrets, environment variables, or volume mounts that are incorrectly configured or don't exist in the cluster.

## Step-by-Step Debugging Guide for CreateContainerConfigError

When facing a **kubernetes CreateContainerConfigError**, follow this systematic debugging approach:

### Step 1: Identify the Problematic Pod

```bash
# List all pods and their status
kubectl get pods

# Output example:
NAME                          READY   STATUS                       RESTARTS   AGE
web-app-7d4b9c8f9-xyz12      0/1     CreateContainerConfigError   0          2m

# Get detailed information about the failing pod
kubectl describe pod web-app-7d4b9c8f9-xyz12

# Look for the Events section at the bottom
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Warning  Failed     1m (x6 over 2m)   kubelet            Error: configmap "app-config" not found

# Check the pod's YAML configuration
kubectl get pod web-app-7d4b9c8f9-xyz12 -o yaml

# Focus on sections like:
# - spec.containers[].env
# - spec.containers[].envFrom
# - spec.volumes
# - spec.containers[].volumeMounts

# Check if ConfigMaps exist
kubectl get configmap

# Check if Secrets exist
kubectl get secret

# Verify specific resources mentioned in the error
kubectl get configmap app-config
kubectl describe configmap app-config

# Deployment referencing non-existent ConfigMap
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: web-app
        envFrom:
        - configMapRef:
            name: app-config  # This ConfigMap doesn't exist

# Check if ConfigMap exists
kubectl get configmap app-config

# Create the missing ConfigMap
kubectl create configmap app-config --from-literal=DATABASE_URL=postgres://localhost:5432/mydb

# Pod spec with missing Secret reference
spec:
  containers:
  - name: web-app
    env:
    - name: API_KEY
      valueFrom:
        secretKeyRef:
          name: api-secrets  # Secret doesn't exist
          key: api-key

# Verify Secret existence
kubectl get secret api-secrets

# Create the missing Secret
kubectl create secret generic api-secrets --from-literal=api-key=your-secret-key

# Incorrect key reference
env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-secret
      key: password  # Correct key might be 'db-password'

# View Secret keys
kubectl get secret db-secret -o yaml

# Or describe for more readable output
kubectl describe secret db-secret

spec:
  containers:
  - name: web-app
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
  volumes:
  - name: config-vol  # Name mismatch with volumeMount
    configMap:
      name: app-config

spec:
  containers:
  - name: web-app
    volumeMounts:
    - name: config-volume  # Must match volume name below
      mountPath: /etc/config
  volumes:
  - name: config-volume  # Corrected name
    configMap:
      name: app-config

# Incorrect indentation
spec:
  containers:
  - name: web-app
    env:
    - name: DATABASE_URL
    valueFrom:  # Wrong indentation
      configMapKeyRef:
        name: app-config
        key: database-url

# Validate YAML before applying
kubectl apply --dry-run=client -f deployment.yaml

# Method 1: From literals
kubectl create configmap app-config \
  --from-literal=DATABASE_URL=postgres://db:5432/app \
  --from-literal=REDIS_URL=redis://cache:6379

# Method 2: From file
kubectl create configmap app-config --from-file=config.properties

# Method 3: From YAML
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  DATABASE_URL: "postgres://db:5432/app"
  REDIS_URL: "redis://cache:6379"
EOF

# Create Secret with multiple key-value pairs
kubectl create secret generic app-secrets \
  --from-literal=api-key=abc123 \
  --from-literal=db-password=secretpass

# Verify Secret creation
kubectl get secret app-secrets -o yaml

# Corrected deployment with proper volume configuration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      - name: web-app
        image: nginx:latest
        volumeMounts:
        - name: config-volume
          mountPath: /etc/nginx/conf.d
        - name: secret-volume
          mountPath: /etc/secrets
          readOnly: true
      volumes:
      - name: config-volume
        configMap:
          name: nginx-config
      - name: secret-volume
        secret:
          secretName: app-secrets

# Always validate your manifests before applying
kubectl apply --dry-run=client -f deployment.yaml -o yaml

# Use kubeval for additional validation (if installed)
kubeval deployment.yaml

# Check resource existence before deployment
kubectl get configmap nginx-config
kubectl get secret app-secrets

# Create a pre-deployment validation script
#!/bin/bash
echo "Validating Kubernetes manifests..."
kubectl apply --dry-run=client -f manifests/ --recursive
echo "Validation complete!"

# Store ConfigMaps in version control
cat > configmap.yaml <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  DATABASE_URL: "postgres://prod-db:5432/app"
  LOG_LEVEL: "INFO"
EOF

# Apply from version control
kubectl apply -f configmap.yaml

# GitLab CI example
validate_k8s:
  stage: validate
  script:
    - kubectl apply --dry-run=client -f k8s/ --recursive
    - kubeval k8s/*.yaml
  only:
    - merge_requests

# Prometheus AlertManager rule example
- alert: PodCreateContainerConfigError
  expr: kube_pod_status_phase{phase="Failed"} > 0
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: "Pod {{ $labels.pod }} has CreateContainerConfigError"

# values.yaml
config:
  databaseUrl: "postgres://db:5432/app"
  redisUrl: "redis://cache:6379"

secrets:
  apiKey: "your-api-key"
  dbPassword: "secure-password"

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
        envFrom:
        - configMapRef:
            name: {{ include "app.fullname" . }}-config
        - secretRef:
            name: {{ include "app.fullname" . }}-secrets