Home / BeaverDeck / Docs / Insights Guide / Configuration Insights / Missing References

Missing References

BeaverDeck uses this check to identify a specific configuration condition that may need operator review.

Permissions: viewing checks requires insights: view. Opening a linked object or logs requires the corresponding resource permission, and the BeaverDeck ServiceAccount must be allowed to read the Kubernetes resources used by the check. Suppressing a finding requires insights: edit and affects all users.

Check type	`missing-references`
Insights section	Configuration Insights
Alert severity	Critical

When It Reports A Finding

An active Pod references a required Secret or ConfigMap object that does not exist in the same namespace. The scan covers imagePullSecrets, Secret/ConfigMap volumes, projected volumes, envFrom, and environment key references for init, application, and ephemeral containers. Optional references are ignored.

Why This Is A Problem

Missing configuration can prevent image pulls, environment injection, or volume mounts, leaving containers unable to start or operate correctly.

Recommended Response

Use the finding details to identify the exact reference context and missing object name.
Create the intended Secret or ConfigMap in the Pod namespace, or correct the reference in the owning workload.
Mark a reference optional only when the application is designed to operate safely without it.
Replace or restart the managed Pod after fixing the workload and confirm that mounts and environment setup succeed.

Scope And Limitations

The check verifies object existence, not whether a referenced key exists inside the Secret or ConfigMap, whether its value is valid, or whether the configuration is current.

After remediation: refresh Configuration Insights and verify the underlying resource or metric. Suppress the finding only when the condition is intentional and its risk is accepted.