kustomize secretGenerator renders a Secret with zero data keys
Routes kustomize empty-secret surprises. Use when a secretGenerator entry produces a Secret with no data (literals/files/envs missing or empty). Not for duplicate or patch errors.
A secretGenerator entry with no literals, no files, and no envs renders a perfectly valid Secret with zero data keys - kustomize does not warn. Downstream apps then fail with authentication errors that look like bad credentials. Inspect the built output (kustomize build | grep -A5 kind:.Secret), find the empty generator, and give it its literals/files/envs - or an ExternalSecret if the values must not live in git.
The error
(no error - kustomize build succeeds but the Secret has zero data keys, and consumers fail with auth errors)What to do
- Inspect what the generator produced:
kustomize build [dir] | grep -B2 -A8 'kind: Secret'Expected: Shows a Secret with no data section.
- Find the generator:
grep -rn -A6 'secretGenerator' kustomization.yamlExpected: Shows the entry with no literals/files/envs.
Populate it (literals for non-sensitive, files/envs otherwise) or replace with an ExternalSecret for real secrets. Expected: Generator has sources.
Rebuild and re-check. Expected: Secret now carries data keys.
When this applies
- apps failing auth right after a kustomize-based deploy
- Secret objects with empty data in built output
- secretGenerator entries copied as stubs
When it does NOT apply
- kustomize build errors (the build succeeds here)
- secrets that exist but have wrong values
Works with
kustomize 4.x/5.x
configMapGenerator with no sources behaves the same way
Empty ConfigMap, same silent shape. Same inspect-and-populate fix.
Why it happens
Generators are declarative: kustomize renders exactly what the entry describes, and an entry describing nothing renders an empty object. There is no required-fields validation on generators.
Edge cases
- envs files with only comments/blank lines also produce empty secrets - check the file contents, not just the reference.
- If the only hits for the secret name are the generator and the consumer, nothing ever populated it - no rerun will help.
Resolved from
gh:kg6zjl/clusters (silent-failure-jobs) - https://github.com/kg6zjl/clusters/blob/HEAD/home-cluster/ai-services/hermes-skills/devops/kubernetes-object-ownership/references/silent-failure-jobs.md