"DeploymentPropertyNotAllowedException" in Spring Cloud Data Flow for Kubernetes

Products

• VMware Tanzu Data Suite

Issue/Introduction

When deploying a stream in Spring Cloud Data Flow (SCDF) for Kubernetes, the web UI displays the following error message:

Could not install AppDeployRequest [[AppDeploymentRequest@#### deploymentProperties = map['spring.cloud.deployer.kubernetes.configMapRefs' -> '####'] ...]]

Environment

Spring Cloud Data Flow for Kubernetes 1.6.14 and higher

Spring Cloud Skipper 2.11.x and higher

Cause

Starting in SCDF 1.6.14, underlying deployer updates enforce explicit security allow-lists for external resource references. ConfigMap and Secret references are denied by default.

Skipper requires exact, comma-separated resource names configured on the platform account to permit deployment. Wildcard patterns (such as .*) are not supported.

Resolution

Add the required ConfigMap and Secret names to the Skipper default account allow-list and restart the Skipper deployment.

1. Step 1: Update Skipper Configuration
   • Method A: Environment Variables (kubectl set env)
     
     Apply environment variables containing exact, comma-separated ConfigMap and Secret names to the Skipper deployment:
     

     kubectl set env deployment/skipper \
       SPRING_CLOUD_SKIPPER_SERVER_PLATFORM_KUBERNETES_ACCOUNTS_DEFAULT_ALLOWEDCONFIGMAPNAMES="####-configmap-1,####-configmap-2" \
       SPRING_CLOUD_SKIPPER_SERVER_PLATFORM_KUBERNETES_ACCOUNTS_DEFAULT_ALLOWEDSECRETNAMES="####-secret-1,####-secret-2" \
       -n <your-namespace>

      

   • Method B: Helm / Carvel (values.yaml)
     Add the explicit resource names to the default account block in the deployment values:
     
     

     skipper:
       config:
         spring:
           cloud:
             skipper:
               server:
                 platform:
                   kubernetes:
                     accounts:
                       default:
                         allowedConfigMapNames: "<configmap-1>,<configmap-2>"
                         allowedSecretNames: "<secret-1>,<secret-2>"

      

2. Step 2: Restart and Verify Skipper
   1. Monitor the rollout status until the new pod reaches Ready state:
      

      kubectl rollout status deployment/skipper -n <your-namespace>

   2. Undeploy any failed stream residue from the SCDF UI or Shell.
   3. Redeploy the stream.
      
      
      

Additional Information

• Wildcard regular expressions (e.g., .* or configmap-.*) are not supported by the property validator.
• Every new ConfigMap or Secret referenced in future stream deployment properties must be appended to the Skipper allow-list configuration.