[BUG] backup-policy-driver-controller failed to reconcile: sharding components shard not found

[JashBook]

Describe the bug

When a Cluster uses sharding with a shared system account (defined in ShardingDefinition with shared: true), the component controller keeps requeuing with:

wait for referenced account secret <namespace>/<cluster>-<shard>-default revision

  Warning  ReconcileBackupPolicyFail  4m22s (x17 over 9m50s)  backup-policy-driver-controller  failed to reconcile: sharding components shard not found

The shard Component never progresses past the ProvisioningStarted condition and has no ApplyResources condition, so the cluster is stuck in Creating phase.

Root cause: clusterShardingAccountTransformer.rewriteSystemAccount updates transCtx.shardings[i].Template.SystemAccounts and transCtx.shardingComps[shardingName] with the correct SecretRef + SecretRefRevision, but it does not update transCtx.shardingCompsWithTpl.

clusterComponentTransformer.buildComps uses transCtx.shardingCompsWithTpl as the source of truth when creating Component CRs. Since shardingCompsWithTpl is populated by clusterNormalizationTransformer (which runs before clusterShardingAccountTransformer), the Component spec ends up with an empty secretRefRevision.

The component controller then checks in componentAccountTransformer.getPasswordFromSecret:

if revision, ok := secret.Annotations[constant.SecretRevisionAnnotationKey]; ok && revision != account.SecretRefRevision {
    return nil, ctrlutil.NewRequeueError(time.Second,
        fmt.Sprintf("wait for referenced account secret %s/%s revision %s", ...))
}

The shared account Secret (created by the cluster controller) has a non-empty revision annotation, but account.SecretRefRevision is empty ("") on the Component spec, so the condition revision != "" is true and the component requeues forever.

To Reproduce

1. Deploy KubeBlocks 1.1.0-beta.9 (or any build with the SecretRefRevision field, introduced in PR fix(apps): reconcile shared account secret rotations #10743)
2. Install an addon that defines a sharding topology with shared system accounts (e.g. redis cluster topology, where ShardingDefinition has systemAccounts[0].shared: true)
3. Create a Cluster CR with sharding topology (e.g. redis cluster mode, apps.kubeblocks.io/v1)

apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  name: rediscl-cfwziv
  namespace: default
spec:
  clusterDef: redis
  topology: cluster
  terminationPolicy: DoNotTerminate
  services:
  - componentSelector: shard
    name: secondary
    serviceName:  shard-secondary
    roleSelector: secondary
    spec:
      ports:
        - name: redis-cluster
          port: 6379
          protocol: TCP
          targetPort: redis-cluster
  shardings:
  - name: shard
    shards: 3
    shardingDef: redis-cluster
    template:
      name: redis
      componentDef: redis-cluster-8-1.1.0-alpha.0
      serviceVersion: 8.0.1
      replicas: 2
      services:
      - name: redis-advertised
        serviceType: NodePort
        podService: true
      systemAccounts:
      - disabled: false
        name: default
        secretRef:
          name: rediscl-cfwziv-shard-default
          namespace: default
          password: password
      resources:
        limits:
          cpu: 100m
          memory: 0.5Gi
        requests:
          cpu: 100m
          memory: 0.5Gi
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      volumeClaimTemplates:
        - name: data
          spec:
            storageClassName: 
            accessModes:
              - ReadWriteOnce
            resources:
               requests:
                 storage: 20Gi

4. Observe:
   • Cluster shows ApplyResourcesSucceed: True and Phase: Creating
   • Shard Components are created but stay with only ProvisioningStarted condition, no ApplyResources condition
   • Component controller logs repeat: wait for referenced account secret <cluster>-shard-default revision

kubectl get cluster rediscl-cfwziv
NAME             CLUSTER-DEFINITION   TERMINATION-POLICY   STATUS   AGE
rediscl-cfwziv   redis                DoNotTerminate                9m39s
➜  ~ 
➜  ~ kubectl describe cluster rediscl-cfwziv 
Name:         rediscl-cfwziv
Namespace:    default
Labels:       clusterdefinition.kubeblocks.io/name=redis
Annotations:  kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
API Version:  apps.kubeblocks.io/v1
Kind:         Cluster
Metadata:
  Creation Timestamp:  2026-08-12T10:44:28Z
  Finalizers:
    cluster.kubeblocks.io/finalizer
  Generation:        1
  Resource Version:  266082682
  UID:               e5fbf384-475e-486c-aa67-8e23abc70c5d
Spec:
  Cluster Def:  redis
  Services:
    Component Selector:  shard
    Name:                secondary
    Role Selector:       secondary
    Service Name:        shard-secondary
    Spec:
      Ports:
        Name:         redis-cluster
        Port:         6379
        Protocol:     TCP
        Target Port:  redis-cluster
  Shardings:
    Name:          shard
    Sharding Def:  redis-cluster
    Shards:        3
    Template:
      Component Def:          redis-cluster-8-1.1.0-alpha.0
      Flat Instance Ordinal:  false
      Name:                   redis
      Persistent Volume Claim Retention Policy:
        When Deleted:     Delete
      Pod Update Policy:  PreferInPlace
      Replicas:           2
      Resources:
        Limits:
          Cpu:     100m
          Memory:  0.5Gi
        Requests:
          Cpu:          100m
          Memory:       0.5Gi
      Service Version:  8.0.1
      Services:
        Name:          redis-advertised
        Pod Service:   true
        Service Type:  NodePort
      System Accounts:
        Disabled:  false
        Name:      default
        Secret Ref:
          Name:       rediscl-cfwziv-shard-default
          Namespace:  default
          Password:   password
      Volume Claim Templates:
        Name:  data
        Spec:
          Access Modes:
            ReadWriteOnce
          Resources:
            Requests:
              Storage:  20Gi
  Termination Policy:   DoNotTerminate
  Topology:             cluster
Status:
  Conditions:
    Last Transition Time:  2026-08-12T10:44:28Z
    Message:               The operator has started the provisioning of Cluster: rediscl-cfwziv
    Observed Generation:   1
    Reason:                PreCheckSucceed
    Status:                True
    Type:                  ProvisioningStarted
    Last Transition Time:  2026-08-12T10:44:28Z
    Message:               secrets "rediscl-cfwziv-shard-default" not found
    Reason:                ApplyResourcesFailed
    Status:                False
    Type:                  ApplyResources
Events:
  Type     Reason                     Age                     From                             Message
  ----     ------                     ----                    ----                             -------
  Normal   PreCheckSucceed            9m50s                   cluster-controller               The operator has started the provisioning of Cluster: rediscl-cfwziv
  Warning  Warning                    9m40s (x12 over 9m50s)  cluster-controller               secrets "rediscl-cfwziv-shard-default" not found
  Warning  ApplyResourcesFailed       4m22s (x17 over 9m50s)  cluster-controller               secrets "rediscl-cfwziv-shard-default" not found
  Warning  ReconcileBackupPolicyFail  4m22s (x17 over 9m50s)  backup-policy-driver-controller  failed to reconcile: sharding components shard not found

logs KB

kubectl logs -l app.kubernetes.io/name=kubeblocks --namespace kb-system --tail 20
2026-08-12T10:49:56.186Z	INFO	sharding components shard not found	{"controller": "cluster", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Cluster", "Cluster": {"name":"rediscl-cfwziv","namespace":"default"}, "namespace": "default", "name": "rediscl-cfwziv", "reconcileID": "80ef649a-af9d-4772-8c02-3aa063a8807e", "cluster": {"name":"rediscl-cfwziv","namespace":"default"}}
2026-08-12T10:49:56.186Z	ERROR	Reconciler error	{"controller": "cluster", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Cluster", "Cluster": {"name":"rediscl-cfwziv","namespace":"default"}, "namespace": "default", "name": "rediscl-cfwziv", "reconcileID": "80ef649a-af9d-4772-8c02-3aa063a8807e", "error": "sharding components shard not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:227
2026-08-12T10:55:23.876Z	INFO	sharding components shard not found	{"controller": "cluster", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Cluster", "Cluster": {"name":"rediscl-cfwziv","namespace":"default"}, "namespace": "default", "name": "rediscl-cfwziv", "reconcileID": "6f0889eb-5b78-43d7-b680-82fc8243f927", "cluster": {"name":"rediscl-cfwziv","namespace":"default"}}
2026-08-12T10:55:23.876Z	ERROR	Reconciler error	{"controller": "cluster", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Cluster", "Cluster": {"name":"rediscl-cfwziv","namespace":"default"}, "namespace": "default", "name": "rediscl-cfwziv", "reconcileID": "6f0889eb-5b78-43d7-b680-82fc8243f927", "error": "sharding components shard not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.2/pkg/internal/controller/controller.go:227

Expected behavior

[leon-ape]

Thanks for the report. We cannot confirm the issue based on the currently available information. Could you please provide the following details so that we can reproduce and verify it?

1. The exact KubeBlocks image tag, Helm chart version, addon version, and whether this was a fresh installation or an upgrade.

2. Whether the Cluster and Component CRDs were updated during installation/upgrade.

3. The original Cluster YAML that was submitted, before any controller reconciliation or write-back.

4. The complete live YAML for the affected Cluster and shard Components:

   kubectl get cluster rediscl-cfwziv -n default -o yaml
   kubectl get component -n default -l apps.kubeblocks.io/sharding-name=shard -o yaml

5. The affected Secret metadata, labels, annotations, UID/resourceVersion, and data key names. Please redact all values under data and stringData:

   kubectl get secret rediscl-cfwziv-shard-default -n default -o yaml

6. The relevant ShardingDefinition and ComponentDefinition YAML, especially their systemAccounts configuration.

7. Confirmation that the live CRDs contain the secretRefRevision field:

   kubectl get crd clusters.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
   kubectl get crd components.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision

8. Complete cluster-controller, component-controller, and backup-policy-driver-controller logs from the initial Cluster creation through the repeated failure, including timestamps and the full revision-related messages.

[JashBook]

kubectl get crd components.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision

kubectl get cluster rediscl-cfwziv -n default -o yaml
apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  annotations:
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps.kubeblocks.io/v1","kind":"Cluster","metadata":{"annotations":{},"name":"rediscl-cfwziv","namespace":"default"},"spec":{"clusterDef":"redis","services":[{"componentSelector":"shard","name":"secondary","roleSelector":"secondary","serviceName":"shard-secondary","spec":{"ports":[{"name":"redis-cluster","port":6379,"protocol":"TCP","targetPort":"redis-cluster"}]}}],"shardings":[{"name":"shard","shardingDef":"redis-cluster","shards":3,"template":{"componentDef":"redis-cluster-8-1.1.0-alpha.0","name":"redis","persistentVolumeClaimRetentionPolicy":{"whenDeleted":"Delete"},"replicas":1,"resources":{"limits":{"cpu":"100m","memory":"0.5Gi"},"requests":{"cpu":"100m","memory":"0.5Gi"}},"serviceVersion":"8.0.1","services":[{"name":"redis-advertised","podService":true,"serviceType":"NodePort"}],"systemAccounts":[{"disabled":false,"name":"default","secretRef":{"name":"rediscl-cfwziv-shard-default","namespace":"default","password":"password"}}],"volumeClaimTemplates":[{"name":"data","spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"20Gi"}},"storageClassName":null}}]}}],"terminationPolicy":"Delete","topology":"cluster"}}
  creationTimestamp: "2026-08-13T03:30:53Z"
  finalizers:
  - cluster.kubeblocks.io/finalizer
  generation: 1
  labels:
    clusterdefinition.kubeblocks.io/name: redis
  name: rediscl-cfwziv
  namespace: default
  resourceVersion: "266478643"
  uid: 0b0faebb-fce6-4264-9af8-d018b79129e2
spec:
  clusterDef: redis
  services:
  - componentSelector: shard
    name: secondary
    roleSelector: secondary
    serviceName: shard-secondary
    spec:
      ports:
      - name: redis-cluster
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
  shardings:
  - name: shard
    shardingDef: redis-cluster
    shards: 3
    template:
      componentDef: redis-cluster-8-1.1.0-alpha.0
      flatInstanceOrdinal: false
      name: redis
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      podUpdatePolicy: PreferInPlace
      replicas: 1
      resources:
        limits:
          cpu: 100m
          memory: 0.5Gi
        requests:
          cpu: 100m
          memory: 0.5Gi
      serviceVersion: 8.0.1
      services:
      - name: redis-advertised
        podService: true
        serviceType: NodePort
      systemAccounts:
      - disabled: false
        name: default
        secretRef:
          name: rediscl-cfwziv-shard-default
          namespace: default
          password: password
      volumeClaimTemplates:
      - name: data
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi
  terminationPolicy: Delete
  topology: cluster
status:
  conditions:
  - lastTransitionTime: "2026-08-13T03:30:53Z"
    message: 'The operator has started the provisioning of Cluster: rediscl-cfwziv'
    observedGeneration: 1
    reason: PreCheckSucceed
    status: "True"
    type: ProvisioningStarted
  - lastTransitionTime: "2026-08-13T03:30:53Z"
    message: secrets "rediscl-cfwziv-shard-default" not found
    reason: ApplyResourcesFailed
    status: "False"
    type: ApplyResources

kubectl get component -n default -l apps.kubeblocks.io/sharding-name=shard -o yaml
apiVersion: v1
items: []
kind: List
metadata:
  resourceVersion: ""

kubectl get secret rediscl-cfwziv-shard-default -n default -o yaml
Error from server (NotFound): secrets "rediscl-cfwziv-shard-default" not found

➜  ~ kubectl get crd clusters.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
➜  ~ 
➜  ~ kubectl get crd components.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
➜  ~ 

[leon-ape]

Thanks for the information. The reported issue still cannot be confirmed from this reproduction:

• Neither live CRD contains secretRefRevision.
• The submitted Cluster references rediscl-cfwziv-shard-default, but that Secret does not exist.
• No shard Component has been created.

Please provide the following additional information and retry:

1. The exact KubeBlocks image tag, Helm chart version, addon version, and whether this was a fresh installation or an upgrade.
2. Update both Cluster and Component CRDs to the versions shipped with v1.1.0-beta.9, then confirm that secretRefRevision exists in both live CRDs.
3. Retry in a clean namespace with a valid referenced source Secret, or without specifying systemAccounts[].secretRef if KubeBlocks should generate the shared account Secret.
4. Provide the new Cluster, Component, and Secret YAML after the retry, with Secret values redacted.
5. Provide the relevant ShardingDefinition and ComponentDefinition YAML.
6. Provide the complete controller logs from the new Cluster creation through the failure, if it still occurs.

[JashBook]

Thanks for the information. The reported issue still cannot be confirmed from this reproduction:

• Neither live CRD contains secretRefRevision.
• The submitted Cluster references rediscl-cfwziv-shard-default, but that Secret does not exist.
• No shard Component has been created.

Please provide the following additional information and retry:

1. The exact KubeBlocks image tag, Helm chart version, addon version, and whether this was a fresh installation or an upgrade.
2. Update both Cluster and Component CRDs to the versions shipped with v1.1.0-beta.9, then confirm that secretRefRevision exists in both live CRDs.
3. Retry in a clean namespace with a valid referenced source Secret, or without specifying systemAccounts[].secretRef if KubeBlocks should generate the shared account Secret.
4. Provide the new Cluster, Component, and Secret YAML after the retry, with Secret values redacted.
5. Provide the relevant ShardingDefinition and ComponentDefinition YAML.
6. Provide the complete controller logs from the new Cluster creation through the failure, if it still occurs.

after replace crd still failed

➜  ~ kubectl get cluster rediscl-cfwziv -n default -o yaml
apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  annotations:
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps.kubeblocks.io/v1","kind":"Cluster","metadata":{"annotations":{},"name":"rediscl-cfwziv","namespace":"default"},"spec":{"clusterDef":"redis","services":[{"componentSelector":"shard","name":"secondary","roleSelector":"secondary","serviceName":"shard-secondary","spec":{"ports":[{"name":"redis-cluster","port":6379,"protocol":"TCP","targetPort":"redis-cluster"}]}}],"shardings":[{"name":"shard","shardingDef":"redis-cluster","shards":3,"template":{"componentDef":"redis-cluster-8-1.1.0-alpha.0","name":"redis","persistentVolumeClaimRetentionPolicy":{"whenDeleted":"Delete"},"replicas":1,"resources":{"limits":{"cpu":"100m","memory":"0.5Gi"},"requests":{"cpu":"100m","memory":"0.5Gi"}},"serviceVersion":"8.4.0","services":[{"name":"redis-advertised","podService":true,"serviceType":"NodePort"}],"systemAccounts":[{"disabled":false,"name":"default","secretRef":{"name":"rediscl-cfwziv-shard-default","namespace":"default","password":"password"}}],"volumeClaimTemplates":[{"name":"data","spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"20Gi"}},"storageClassName":null}}]}}],"terminationPolicy":"DoNotTerminate","topology":"cluster"}}
  creationTimestamp: "2026-08-13T03:44:24Z"
  finalizers:
  - cluster.kubeblocks.io/finalizer
  generation: 1
  labels:
    clusterdefinition.kubeblocks.io/name: redis
  name: rediscl-cfwziv
  namespace: default
  resourceVersion: "266486244"
  uid: 0c5d9cdd-235b-41da-92c7-3c0284e3ec82
spec:
  clusterDef: redis
  services:
  - componentSelector: shard
    name: secondary
    roleSelector: secondary
    serviceName: shard-secondary
    spec:
      ports:
      - name: redis-cluster
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
  shardings:
  - name: shard
    shardingDef: redis-cluster
    shards: 3
    template:
      componentDef: redis-cluster-8-1.1.0-alpha.0
      flatInstanceOrdinal: false
      name: redis
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      podUpdatePolicy: PreferInPlace
      replicas: 1
      resources:
        limits:
          cpu: 100m
          memory: 0.5Gi
        requests:
          cpu: 100m
          memory: 0.5Gi
      serviceVersion: 8.4.0
      services:
      - name: redis-advertised
        podService: true
        serviceType: NodePort
      systemAccounts:
      - disabled: false
        name: default
        secretRef:
          name: rediscl-cfwziv-shard-default
          namespace: default
          password: password
      volumeClaimTemplates:
      - name: data
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi
  terminationPolicy: DoNotTerminate
  topology: cluster
status:
  conditions:
  - lastTransitionTime: "2026-08-13T03:44:24Z"
    message: 'The operator has started the provisioning of Cluster: rediscl-cfwziv'
    observedGeneration: 1
    reason: PreCheckSucceed
    status: "True"
    type: ProvisioningStarted
  - lastTransitionTime: "2026-08-13T03:44:24Z"
    message: secrets "rediscl-cfwziv-shard-default" not found
    reason: ApplyResourcesFailed
    status: "False"
    type: ApplyResources
➜  ~ 
➜  ~ kubectl get component -n default -l apps.kubeblocks.io/sharding-name=shard -o yaml
apiVersion: v1
items: []
kind: List
metadata:
  resourceVersion: ""
➜  ~ 
➜  ~ kubectl get secret rediscl-cfwziv-shard-default -n default -o yaml
Error from server (NotFound): secrets "rediscl-cfwziv-shard-default" not found
➜  ~ 
➜  ~ kubectl get crd clusters.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
4385-                                  the password.
4386-                                type: string
4387-                            required:
4388-                            - name
4389-                            type: object
4390:                          secretRefRevision:
4391-                            description: |-
4392-                              Specifies an opaque revision of the referenced Secret.
4393-
4394-                              After updating the referenced Secret, change this field to a new value to apply
4395-                              the updated credentials. The value is treated as an opaque token.
4396-                            type: string
4397-                        required:
4398-                        - name
4399-                        type: object
4400-                        x-kubernetes-validations:
4401:                        - message: secretRef must be specified when secretRefRevision
4402-                            is non-empty
4403:                          rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
4404-                            == 0 || has(self.secretRef)'
4405-                      type: array
4406-                    tls:
4407-                      description: |-
4408-                        A boolean flag that indicates whether the Component should use Transport Layer Security (TLS)
--
15605-                                      the password.
15606-                                    type: string
15607-                                required:
15608-                                - name
15609-                                type: object
15610:                              secretRefRevision:
15611-                                description: |-
15612-                                  Specifies an opaque revision of the referenced Secret.
15613-
15614-                                  After updating the referenced Secret, change this field to a new value to apply
15615-                                  the updated credentials. The value is treated as an opaque token.
15616-                                type: string
15617-                            required:
15618-                            - name
15619-                            type: object
15620-                            x-kubernetes-validations:
15621:                            - message: secretRef must be specified when secretRefRevision
15622-                                is non-empty
15623:                              rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
15624-                                == 0 || has(self.secretRef)'
15625-                          type: array
15626-                        tls:
15627-                          description: |-
15628-                            A boolean flag that indicates whether the Component should use Transport Layer Security (TLS)
➜  ~ kubectl get crd components.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
5016-                            password.
5017-                          type: string
5018-                      required:
5019-                      - name
5020-                      type: object
5021:                    secretRefRevision:
5022-                      description: |-
5023-                        Specifies an opaque revision of the referenced Secret.
5024-
5025-                        After updating the referenced Secret, change this field to a new value to apply
5026-                        the updated credentials. The value is treated as an opaque token.
5027-                      type: string
5028-                  required:
5029-                  - name
5030-                  type: object
5031-                  x-kubernetes-validations:
5032:                  - message: secretRef must be specified when secretRefRevision is
5033-                      non-empty
5034:                    rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
5035-                      == 0 || has(self.secretRef)'
5036-                type: array
5037-              terminationPolicy:
5038-                default: Delete
5039-                description: Specifies the behavior when a Component is deleted.
➜  ~ 

KubeBlocks version

kubectl get deployment -n kb-system kubeblocks -oyaml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "43"
    meta.helm.sh/release-name: kubeblocks
    meta.helm.sh/release-namespace: kb-system
  creationTimestamp: "2025-12-05T09:24:04Z"
  generation: 81
  labels:
    app.kubernetes.io/component: apps
    app.kubernetes.io/instance: kubeblocks
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubeblocks
    app.kubernetes.io/version: 1.1.0-beta.9
    helm.sh/chart: kubeblocks-1.1.0-beta.9
  name: kubeblocks
  namespace: kb-system
  resourceVersion: "265531767"
  uid: 57f09e72-cc09-4e9d-ba3e-bbdcc18adb7e
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: apps
      app.kubernetes.io/instance: kubeblocks
      app.kubernetes.io/name: kubeblocks
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 40%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/component: apps
        app.kubernetes.io/instance: kubeblocks
        app.kubernetes.io/name: kubeblocks
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: kb-controller
                operator: In
                values:
                - "true"
            weight: 100
      containers:
      - args:
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=:8080
        - --leader-elect
        - --leader-elect-id=001c317f
        - --zap-devel=false
        - --zap-time-encoding=iso8601
        - --zap-encoder=console
        - --apps=true
        - --workloads=true
        - --operations=true
        - --extensions=true
        - --experimental=false
        - --trace=false
        - --user-agent=kubeblocks
        env:
        - name: CM_NAMESPACE
          value: kb-system
        - name: CM_AFFINITY
          value: '{"nodeAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"preference":{"matchExpressions":[{"key":"kb-controller","operator":"In","values":["true"]}]},"weight":100}]}}'
        - name: CM_TOLERATIONS
          value: '[{"effect":"NoSchedule","key":"kb-controller","operator":"Equal","value":"true"}]'
        - name: OPERATION_ZERO_RESOURCE_FOR_UNSET
          value: "true"
        - name: KUBEBLOCKS_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: KUBEBLOCKS_IMAGE_PULL_SECRETS
          value: '[{"name":"kbcli-test-registry-key"}]'
        - name: KUBEBLOCKS_TOOLS_IMAGE
          value: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.1.0-beta.9
        - name: KUBEBLOCKS_SERVICEACCOUNT_NAME
          value: kubeblocks
        - name: CLUSTER_DEFAULT_RESOURCES
          value: '{"limits":{},"requests":{},"zero":true}'
        - name: VOLUMESNAPSHOT_API_BETA
          value: "false"
        - name: ENABLE_RBAC_MANAGER
          value: "true"
        - name: ADDON_JOB_TTL
          value: 5m
        - name: ADDON_JOB_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: KUBEBLOCKS_ADDON_HELM_INSTALL_OPTIONS
          value: --atomic --cleanup-on-fail --wait --insecure-skip-tls-verify
        - name: KUBEBLOCKS_ADDON_CHARTS_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: DP_ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              key: dataProtectionEncryptionKey
              name: kubeblocks-secret
        - name: KUBE_PROVIDER
        - name: HOST_PORT_INCLUDE_RANGES
          value: 1025-65536
        - name: HOST_PORT_EXCLUDE_RANGES
          value: 6443,10250,10257,10259,2379-2380,30000-32767
        - name: HOST_PORT_CM_NAME
          value: kubeblocks-host-ports
        - name: COMPONENT_REPLICAS_ANNOTATION
          value: "true"
        - name: IN_PLACE_POD_VERTICAL_SCALING
          value: "false"
        image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks:1.1.0-beta.9
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: health
            scheme: HTTP
          initialDelaySeconds: 15
          periodSeconds: 20
          successThreshold: 1
          timeoutSeconds: 1
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        - containerPort: 8081
          name: health
          protocol: TCP
        - containerPort: 8080
          name: metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: health
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: 500m
            memory: 1Gi
          requests:
            cpu: 500m
            memory: 1Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/kubeblocks
          name: manager-config
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: kbcli-test-registry-key
      initContainers:
      - command:
        - /bin/true
        image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.1.0-beta.9
        imagePullPolicy: IfNotPresent
        name: tools
        resources:
          limits:
            cpu: 50m
            memory: 64Mi
          requests:
            cpu: 50m
            memory: 64Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        runAsNonRoot: true
      serviceAccount: kubeblocks
      serviceAccountName: kubeblocks
      terminationGracePeriodSeconds: 10
      tolerations:
      - effect: NoSchedule
        key: kb-controller
        operator: Equal
        value: "true"
      volumes:
      - configMap:
          defaultMode: 420
          name: kubeblocks-manager-config
        name: manager-config
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2025-12-05T09:24:04Z"
    lastUpdateTime: "2026-08-11T02:11:01Z"
    message: ReplicaSet "kubeblocks-5c844dc677" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  - lastTransitionTime: "2026-08-11T10:48:26Z"
    lastUpdateTime: "2026-08-11T10:48:26Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 81
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1
➜  ~ 
➜  ~ helm list -n kb-system     
NAME               	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART                     	APP VERSION              
kb-addon-redis     	kb-system	1       	2026-08-13 11:30:23.20411 +0800 CST    	deployed	redis-1.1.0-alpha.0       	7.2.7            
kubeblocks         	kb-system	88      	2026-08-11 10:10:30.908184 +0800 CST   	deployed	kubeblocks-1.1.0-beta.9   	1.1.0-beta.9    

helm get notes -n kb-system kb-addon-redis
NOTES:
Release Information:
  Commit ID: "1c8380ba8aad98a1282ff176d6d622468d47c41e"
  Commit Time: "2026-06-24 10:15:29 +0800"
  Release Branch: "v1.1.0-beta.9"
  Release Time:  "2026-08-07 11:50:40 +0800"
  Enterprise: "false"

[JashBook]

Thanks for the information. The reported issue still cannot be confirmed from this reproduction:

• Neither live CRD contains secretRefRevision.
• The submitted Cluster references rediscl-cfwziv-shard-default, but that Secret does not exist.
• No shard Component has been created.

Please provide the following additional information and retry:

1. The exact KubeBlocks image tag, Helm chart version, addon version, and whether this was a fresh installation or an upgrade.
2. Update both Cluster and Component CRDs to the versions shipped with v1.1.0-beta.9, then confirm that secretRefRevision exists in both live CRDs.
3. Retry in a clean namespace with a valid referenced source Secret, or without specifying systemAccounts[].secretRef if KubeBlocks should generate the shared account Secret.
4. Provide the new Cluster, Component, and Secret YAML after the retry, with Secret values redacted.
5. Provide the relevant ShardingDefinition and ComponentDefinition YAML.
6. Provide the complete controller logs from the new Cluster creation through the failure, if it still occurs.

after replace crd still failed

➜  ~ kubectl get cluster rediscl-cfwziv -n default -o yaml
apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  annotations:
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps.kubeblocks.io/v1","kind":"Cluster","metadata":{"annotations":{},"name":"rediscl-cfwziv","namespace":"default"},"spec":{"clusterDef":"redis","services":[{"componentSelector":"shard","name":"secondary","roleSelector":"secondary","serviceName":"shard-secondary","spec":{"ports":[{"name":"redis-cluster","port":6379,"protocol":"TCP","targetPort":"redis-cluster"}]}}],"shardings":[{"name":"shard","shardingDef":"redis-cluster","shards":3,"template":{"componentDef":"redis-cluster-8-1.1.0-alpha.0","name":"redis","persistentVolumeClaimRetentionPolicy":{"whenDeleted":"Delete"},"replicas":1,"resources":{"limits":{"cpu":"100m","memory":"0.5Gi"},"requests":{"cpu":"100m","memory":"0.5Gi"}},"serviceVersion":"8.4.0","services":[{"name":"redis-advertised","podService":true,"serviceType":"NodePort"}],"systemAccounts":[{"disabled":false,"name":"default","secretRef":{"name":"rediscl-cfwziv-shard-default","namespace":"default","password":"password"}}],"volumeClaimTemplates":[{"name":"data","spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"20Gi"}},"storageClassName":null}}]}}],"terminationPolicy":"DoNotTerminate","topology":"cluster"}}
  creationTimestamp: "2026-08-13T03:44:24Z"
  finalizers:
  - cluster.kubeblocks.io/finalizer
  generation: 1
  labels:
    clusterdefinition.kubeblocks.io/name: redis
  name: rediscl-cfwziv
  namespace: default
  resourceVersion: "266486244"
  uid: 0c5d9cdd-235b-41da-92c7-3c0284e3ec82
spec:
  clusterDef: redis
  services:
  - componentSelector: shard
    name: secondary
    roleSelector: secondary
    serviceName: shard-secondary
    spec:
      ports:
      - name: redis-cluster
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
  shardings:
  - name: shard
    shardingDef: redis-cluster
    shards: 3
    template:
      componentDef: redis-cluster-8-1.1.0-alpha.0
      flatInstanceOrdinal: false
      name: redis
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      podUpdatePolicy: PreferInPlace
      replicas: 1
      resources:
        limits:
          cpu: 100m
          memory: 0.5Gi
        requests:
          cpu: 100m
          memory: 0.5Gi
      serviceVersion: 8.4.0
      services:
      - name: redis-advertised
        podService: true
        serviceType: NodePort
      systemAccounts:
      - disabled: false
        name: default
        secretRef:
          name: rediscl-cfwziv-shard-default
          namespace: default
          password: password
      volumeClaimTemplates:
      - name: data
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi
  terminationPolicy: DoNotTerminate
  topology: cluster
status:
  conditions:
  - lastTransitionTime: "2026-08-13T03:44:24Z"
    message: 'The operator has started the provisioning of Cluster: rediscl-cfwziv'
    observedGeneration: 1
    reason: PreCheckSucceed
    status: "True"
    type: ProvisioningStarted
  - lastTransitionTime: "2026-08-13T03:44:24Z"
    message: secrets "rediscl-cfwziv-shard-default" not found
    reason: ApplyResourcesFailed
    status: "False"
    type: ApplyResources
➜  ~ 
➜  ~ kubectl get component -n default -l apps.kubeblocks.io/sharding-name=shard -o yaml
apiVersion: v1
items: []
kind: List
metadata:
  resourceVersion: ""
➜  ~ 
➜  ~ kubectl get secret rediscl-cfwziv-shard-default -n default -o yaml
Error from server (NotFound): secrets "rediscl-cfwziv-shard-default" not found
➜  ~ 
➜  ~ kubectl get crd clusters.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
4385-                                  the password.
4386-                                type: string
4387-                            required:
4388-                            - name
4389-                            type: object
4390:                          secretRefRevision:
4391-                            description: |-
4392-                              Specifies an opaque revision of the referenced Secret.
4393-
4394-                              After updating the referenced Secret, change this field to a new value to apply
4395-                              the updated credentials. The value is treated as an opaque token.
4396-                            type: string
4397-                        required:
4398-                        - name
4399-                        type: object
4400-                        x-kubernetes-validations:
4401:                        - message: secretRef must be specified when secretRefRevision
4402-                            is non-empty
4403:                          rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
4404-                            == 0 || has(self.secretRef)'
4405-                      type: array
4406-                    tls:
4407-                      description: |-
4408-                        A boolean flag that indicates whether the Component should use Transport Layer Security (TLS)
--
15605-                                      the password.
15606-                                    type: string
15607-                                required:
15608-                                - name
15609-                                type: object
15610:                              secretRefRevision:
15611-                                description: |-
15612-                                  Specifies an opaque revision of the referenced Secret.
15613-
15614-                                  After updating the referenced Secret, change this field to a new value to apply
15615-                                  the updated credentials. The value is treated as an opaque token.
15616-                                type: string
15617-                            required:
15618-                            - name
15619-                            type: object
15620-                            x-kubernetes-validations:
15621:                            - message: secretRef must be specified when secretRefRevision
15622-                                is non-empty
15623:                              rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
15624-                                == 0 || has(self.secretRef)'
15625-                          type: array
15626-                        tls:
15627-                          description: |-
15628-                            A boolean flag that indicates whether the Component should use Transport Layer Security (TLS)
➜  ~ kubectl get crd components.apps.kubeblocks.io -o yaml | grep -n -C 5 secretRefRevision
5016-                            password.
5017-                          type: string
5018-                      required:
5019-                      - name
5020-                      type: object
5021:                    secretRefRevision:
5022-                      description: |-
5023-                        Specifies an opaque revision of the referenced Secret.
5024-
5025-                        After updating the referenced Secret, change this field to a new value to apply
5026-                        the updated credentials. The value is treated as an opaque token.
5027-                      type: string
5028-                  required:
5029-                  - name
5030-                  type: object
5031-                  x-kubernetes-validations:
5032:                  - message: secretRef must be specified when secretRefRevision is
5033-                      non-empty
5034:                    rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
5035-                      == 0 || has(self.secretRef)'
5036-                type: array
5037-              terminationPolicy:
5038-                default: Delete
5039-                description: Specifies the behavior when a Component is deleted.
➜  ~ 

KubeBlocks version

kubectl get deployment -n kb-system kubeblocks -oyaml
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "43"
    meta.helm.sh/release-name: kubeblocks
    meta.helm.sh/release-namespace: kb-system
  creationTimestamp: "2025-12-05T09:24:04Z"
  generation: 81
  labels:
    app.kubernetes.io/component: apps
    app.kubernetes.io/instance: kubeblocks
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubeblocks
    app.kubernetes.io/version: 1.1.0-beta.9
    helm.sh/chart: kubeblocks-1.1.0-beta.9
  name: kubeblocks
  namespace: kb-system
  resourceVersion: "265531767"
  uid: 57f09e72-cc09-4e9d-ba3e-bbdcc18adb7e
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/component: apps
      app.kubernetes.io/instance: kubeblocks
      app.kubernetes.io/name: kubeblocks
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 40%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/component: apps
        app.kubernetes.io/instance: kubeblocks
        app.kubernetes.io/name: kubeblocks
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: kb-controller
                operator: In
                values:
                - "true"
            weight: 100
      containers:
      - args:
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=:8080
        - --leader-elect
        - --leader-elect-id=001c317f
        - --zap-devel=false
        - --zap-time-encoding=iso8601
        - --zap-encoder=console
        - --apps=true
        - --workloads=true
        - --operations=true
        - --extensions=true
        - --experimental=false
        - --trace=false
        - --user-agent=kubeblocks
        env:
        - name: CM_NAMESPACE
          value: kb-system
        - name: CM_AFFINITY
          value: '{"nodeAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"preference":{"matchExpressions":[{"key":"kb-controller","operator":"In","values":["true"]}]},"weight":100}]}}'
        - name: CM_TOLERATIONS
          value: '[{"effect":"NoSchedule","key":"kb-controller","operator":"Equal","value":"true"}]'
        - name: OPERATION_ZERO_RESOURCE_FOR_UNSET
          value: "true"
        - name: KUBEBLOCKS_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: KUBEBLOCKS_IMAGE_PULL_SECRETS
          value: '[{"name":"kbcli-test-registry-key"}]'
        - name: KUBEBLOCKS_TOOLS_IMAGE
          value: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.1.0-beta.9
        - name: KUBEBLOCKS_SERVICEACCOUNT_NAME
          value: kubeblocks
        - name: CLUSTER_DEFAULT_RESOURCES
          value: '{"limits":{},"requests":{},"zero":true}'
        - name: VOLUMESNAPSHOT_API_BETA
          value: "false"
        - name: ENABLE_RBAC_MANAGER
          value: "true"
        - name: ADDON_JOB_TTL
          value: 5m
        - name: ADDON_JOB_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: KUBEBLOCKS_ADDON_HELM_INSTALL_OPTIONS
          value: --atomic --cleanup-on-fail --wait --insecure-skip-tls-verify
        - name: KUBEBLOCKS_ADDON_CHARTS_IMAGE_PULL_POLICY
          value: IfNotPresent
        - name: DP_ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              key: dataProtectionEncryptionKey
              name: kubeblocks-secret
        - name: KUBE_PROVIDER
        - name: HOST_PORT_INCLUDE_RANGES
          value: 1025-65536
        - name: HOST_PORT_EXCLUDE_RANGES
          value: 6443,10250,10257,10259,2379-2380,30000-32767
        - name: HOST_PORT_CM_NAME
          value: kubeblocks-host-ports
        - name: COMPONENT_REPLICAS_ANNOTATION
          value: "true"
        - name: IN_PLACE_POD_VERTICAL_SCALING
          value: "false"
        image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks:1.1.0-beta.9
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: health
            scheme: HTTP
          initialDelaySeconds: 15
          periodSeconds: 20
          successThreshold: 1
          timeoutSeconds: 1
        name: manager
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        - containerPort: 8081
          name: health
          protocol: TCP
        - containerPort: 8080
          name: metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: health
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          limits:
            cpu: 500m
            memory: 1Gi
          requests:
            cpu: 500m
            memory: 1Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/kubeblocks
          name: manager-config
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: kbcli-test-registry-key
      initContainers:
      - command:
        - /bin/true
        image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.1.0-beta.9
        imagePullPolicy: IfNotPresent
        name: tools
        resources:
          limits:
            cpu: 50m
            memory: 64Mi
          requests:
            cpu: 50m
            memory: 64Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        runAsNonRoot: true
      serviceAccount: kubeblocks
      serviceAccountName: kubeblocks
      terminationGracePeriodSeconds: 10
      tolerations:
      - effect: NoSchedule
        key: kb-controller
        operator: Equal
        value: "true"
      volumes:
      - configMap:
          defaultMode: 420
          name: kubeblocks-manager-config
        name: manager-config
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2025-12-05T09:24:04Z"
    lastUpdateTime: "2026-08-11T02:11:01Z"
    message: ReplicaSet "kubeblocks-5c844dc677" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  - lastTransitionTime: "2026-08-11T10:48:26Z"
    lastUpdateTime: "2026-08-11T10:48:26Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  observedGeneration: 81
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1
➜  ~ 
➜  ~ helm list -n kb-system     
NAME               	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART                     	APP VERSION              
kb-addon-redis     	kb-system	1       	2026-08-13 11:30:23.20411 +0800 CST    	deployed	redis-1.1.0-alpha.0       	7.2.7            
kubeblocks         	kb-system	88      	2026-08-11 10:10:30.908184 +0800 CST   	deployed	kubeblocks-1.1.0-beta.9   	1.1.0-beta.9    

helm get notes -n kb-system kb-addon-redis
NOTES:
Release Information:
  Commit ID: "1c8380ba8aad98a1282ff176d6d622468d47c41e"
  Commit Time: "2026-06-24 10:15:29 +0800"
  Release Branch: "v1.1.0-beta.9"
  Release Time:  "2026-08-07 11:50:40 +0800"
  Enterprise: "false"

kubectl get ShardingDefinition redis-cluster -oyaml
apiVersion: apps.kubeblocks.io/v1
kind: ShardingDefinition
metadata:
  annotations:
    apps.kubeblocks.io/immutable-hash: 6b648cb858
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    meta.helm.sh/release-name: kb-addon-redis
    meta.helm.sh/release-namespace: kb-system
  creationTimestamp: "2026-08-13T03:30:27Z"
  finalizers:
  - shardingdefinition.kubeblocks.io/finalizer
  generation: 1
  labels:
    app.kubernetes.io/instance: kb-addon-redis
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: redis
    app.kubernetes.io/version: 7.2.7
    helm.sh/chart: redis-1.1.0-alpha.0
  name: redis-cluster
  resourceVersion: "266478362"
  uid: cd892a26-1fc3-43ac-a162-7764d6314f3b
spec:
  lifecycleActions:
    shardRemove:
      exec:
        command:
        - /bin/bash
        - -c
        - |
          if [ "$LEGACY_REDIS" == "true" ]; then
             /scripts/redis-cluster6-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
          else
             /scripts/redis-cluster-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
          fi
        container: redis-cluster
      retryPolicy:
        maxRetries: 10
        retryInterval: 0
      timeoutSeconds: 600
  provisionStrategy: Parallel
  shardsLimit:
    maxShards: 64
    minShards: 3
  systemAccounts:
  - name: default
    shared: true
  template:
    compDef: ^redis-cluster-\d+
  updateStrategy: Parallel
status:
  observedGeneration: 1
  phase: Available
➜  ~ 
➜  ~ kubectl get ComponentDefinition redis-cluster-8-1.1.0-alpha.0 -oyaml
apiVersion: apps.kubeblocks.io/v1
kind: ComponentDefinition
metadata:
  annotations:
    apps.kubeblocks.io/skip-immutable-check: "true"
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    meta.helm.sh/release-name: kb-addon-redis
    meta.helm.sh/release-namespace: kb-system
  creationTimestamp: "2026-08-13T03:30:26Z"
  finalizers:
  - componentdefinition.kubeblocks.io/finalizer
  generation: 1
  labels:
    app.kubernetes.io/instance: kb-addon-redis
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: redis
    app.kubernetes.io/version: 7.2.7
    helm.sh/chart: redis-1.1.0-alpha.0
  name: redis-cluster-8-1.1.0-alpha.0
  resourceVersion: "266478435"
  uid: 2a585b81-53fd-4e35-87e0-e365609e73e8
spec:
  configs:
  - externalManaged: true
    name: redis-cluster-config
    namespace: kb-system
    template: redis-cluster8-config-template-1.1.0-alpha.0
    volumeName: redis-cluster-config
  description: An official v8.0 Redis Cluster(distributed implementation of Redis)
    component definition for Kubernetes
  disableDefaultHeadlessService: false
  exporter:
    containerName: metrics
    scrapePath: /metrics
    scrapePort: http-metrics
  hostNetwork:
    containerPorts:
    - container: redis-cluster
      ports:
      - redis-cluster
      - cluster-bus
    - container: metrics
      ports:
      - http-metrics
      - server-metrics
  lifecycleActions:
    memberJoin:
      exec:
        command:
        - /bin/bash
        - -c
        - /scripts/sync-acl.sh
        container: redis-cluster
        targetPodSelector: Any
      timeoutSeconds: 0
    memberLeave:
      exec:
        command:
        - /bin/bash
        - -c
        - /scripts/redis-cluster-replica-member-leave.sh > /tmp/member-leave.log 2>&1
        container: redis-cluster
      retryPolicy:
        maxRetries: 10
        retryInterval: 0
      timeoutSeconds: 0
    postProvision:
      exec:
        command:
        - /bin/bash
        - -c
        - /scripts/redis-cluster-manage.sh --post-provision  > /tmp/post-provision.log
          2>&1
        container: redis-cluster
        env:
        - name: CURRENT_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: CURRENT_POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: CURRENT_POD_HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
      preCondition: RuntimeReady
      retryPolicy:
        maxRetries: 10
        retryInterval: 0
      timeoutSeconds: 600
    roleProbe:
      exec:
        command:
        - /tools/dbctl
        - redis
        - getrole
        container: redis-cluster
        env:
        - name: CURRENT_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: KB_HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: KB_POD_FQDN
          value: $(CURRENT_POD_NAME).$(CURRENT_SHARD_COMPONENT_NAME)-headless.$(CLUSTER_NAMESPACE).svc.cluster.local
        - name: KB_CLUSTER_COMP_NAME
          value: $(CURRENT_SHARD_COMPONENT_NAME)
        - name: REDIS_LB_ADVERTISED_HOST
          value: $(CURRENT_SHARD_LB_ADVERTISED_HOST)
        - name: KB_SERVICE_PORT
          value: $(SERVICE_PORT)
      periodSeconds: 1
      timeoutSeconds: 1
    switchover:
      exec:
        command:
        - /bin/bash
        - -c
        - /scripts/redis-cluster-switchover.sh  > /tmp/switchover.log 2>&1
        container: redis-cluster
      timeoutSeconds: 0
  logConfigs:
  - filePathPattern: /data/running.log
    name: running
  minReadySeconds: 10
  podManagementPolicy: OrderedReady
  podUpdatePolicy: PreferInPlace
  podUpgradePolicy: ReCreate
  policyRules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - create
    - get
    - list
    - patch
    - update
    - delete
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - get
    - list
  - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - create
  - apiGroups:
    - apps.kubeblocks.io
    resources:
    - clusters
    verbs:
    - get
    - list
  provider: kubeblocks
  roles:
  - isExclusive: false
    name: primary
    participatesInQuorum: false
    updatePriority: 2
  - isExclusive: false
    name: secondary
    participatesInQuorum: false
    updatePriority: 1
  runtime:
    containers:
    - command:
      - /scripts/redis-cluster-server-start.sh
      env:
      - name: CURRENT_POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: CURRENT_POD_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: CURRENT_POD_HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: POD_FQDN
        value: $(CURRENT_POD_NAME).$(CURRENT_SHARD_COMPONENT_NAME)-headless.$(CLUSTER_NAMESPACE).svc.cluster.local
      imagePullPolicy: IfNotPresent
      lifecycle:
        preStop:
          exec:
            command:
            - /bin/bash
            - -c
            - /scripts/redis-cluster-replica-pre-stop.sh
      name: redis-cluster
      ports:
      - containerPort: 6379
        name: redis-cluster
        protocol: TCP
      - containerPort: 16379
        name: cluster-bus
        protocol: TCP
      readinessProbe:
        exec:
          command:
          - sh
          - -c
          - /scripts/redis-ping.sh
        failureThreshold: 5
        initialDelaySeconds: 10
        periodSeconds: 5
        successThreshold: 1
        timeoutSeconds: 5
      volumeMounts:
      - mountPath: /data
        name: data
      - mountPath: /etc/conf
        name: redis-cluster-config
      - mountPath: /scripts
        name: scripts
      - mountPath: /etc/redis
        name: redis-conf
      - mountPath: /tools
        name: tools
    - env:
      - name: REDIS_ADDR
        value: $(REDIS_METRICS_ADDR)
      - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
        value: 0.0.0.0:$(REDIS_METRICS_HTTP_PORT)
      - name: REDIS_USER
        value: $(REDIS_DEFAULT_USER)
      - name: REDIS_PASSWORD
        value: $(REDIS_DEFAULT_PASSWORD)
      - name: REDIS_EXPORTER_IS_CLUSTER
        value: "true"
      - name: REDIS_EXPORTER_SKIP_TLS_VERIFICATION
        value: "true"
      imagePullPolicy: IfNotPresent
      name: metrics
      ports:
      - containerPort: 9121
        name: http-metrics
        protocol: TCP
      - containerPort: 8888
        name: server-metrics
        protocol: TCP
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
    initContainers:
    - command:
      - cp
      - -r
      - /bin/dbctl
      - /tools/
      imagePullPolicy: IfNotPresent
      name: init-dbctl
      volumeMounts:
      - mountPath: /tools
        name: tools
  scripts:
  - defaultMode: 365
    name: redis-cluster-scripts
    namespace: kb-system
    template: redis-cluster-scripts-template-1.1.0-alpha.0
    volumeName: scripts
  serviceKind: redis-cluster
  serviceVersion: 8.2.2
  services:
  - disableAutoProvision: true
    name: redis-advertised
    podService: true
    serviceName: redis-advertised
    spec:
      ports:
      - name: redis-advertised
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
      - name: advertised-bus
        port: 16379
        protocol: TCP
        targetPort: cluster-bus
      type: NodePort
  - disableAutoProvision: true
    name: redis-lb-advertised
    podService: true
    serviceName: redis-lb-advertised
    spec:
      externalTrafficPolicy: Cluster
      ports:
      - name: redis-advertised
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
      - name: advertised-bus
        port: 16379
        protocol: TCP
        targetPort: cluster-bus
      type: LoadBalancer
  systemAccounts:
  - initAccount: true
    name: default
    passwordGenerationPolicy:
      length: 10
      letterCase: MixedCases
      numDigits: 5
      numSymbols: 0
  tls:
    caFile: ca.crt
    certFile: tls.crt
    keyFile: tls.key
    mountPath: /etc/pki/tls
    volumeName: tls
  updateStrategy: BestEffortParallel
  vars:
  - name: IS_REDIS8
    value: "true"
  - name: TLS_ENABLED
    valueFrom:
      tlsVarRef:
        enabled: Optional
        optional: true
  - name: TLS_MOUNT_PATH
    value: /etc/pki/tls
  - name: CLUSTER_NAME
    valueFrom:
      clusterVarRef:
        clusterName: Required
  - name: CLUSTER_NAMESPACE
    valueFrom:
      clusterVarRef:
        namespace: Required
  - name: COMPONENT_REPLICAS
    valueFrom:
      componentVarRef:
        optional: false
        replicas: Required
  - name: CLUSTER_DOMAIN
    value: cluster.local
  - name: REDIS_DEFAULT_USER
    valueFrom:
      credentialVarRef:
        name: default
        username: Required
  - name: REDIS_DEFAULT_PASSWORD
    valueFrom:
      credentialVarRef:
        name: default
        password: Required
  - name: REDIS_REPL_USER
    value: kbreplicator
  - name: REDIS_REPL_PASSWORD
    valueFrom:
      credentialVarRef:
        name: default
        password: Required
  - name: CURRENT_SHARD_POD_NAME_LIST
    valueFrom:
      componentVarRef:
        optional: false
        podNames: Required
  - name: CURRENT_SHARD_POD_FQDN_LIST
    valueFrom:
      componentVarRef:
        optional: false
        podFQDNs: Required
  - name: CURRENT_SHARD_COMPONENT_NAME
    valueFrom:
      componentVarRef:
        componentName: Required
        optional: false
  - name: CURRENT_SHARD_COMPONENT_SHORT_NAME
    valueFrom:
      componentVarRef:
        optional: false
        shortName: Required
  - name: CURRENT_SHARD_ADVERTISED_PORT
    valueFrom:
      serviceVarRef:
        name: redis-advertised
        optional: true
        port:
          name: redis-advertised
          option: Required
  - name: CURRENT_SHARD_ADVERTISED_BUS_PORT
    valueFrom:
      serviceVarRef:
        name: redis-advertised
        optional: true
        port:
          name: advertised-bus
          option: Required
  - name: CURRENT_SHARD_LB_ADVERTISED_HOST
    valueFrom:
      serviceVarRef:
        host: Required
        loadBalancer: Required
        name: redis-lb-advertised
        optional: true
  - name: CURRENT_SHARD_LB_ADVERTISED_PORT
    valueFrom:
      serviceVarRef:
        name: redis-lb-advertised
        optional: true
        port:
          name: redis-advertised
          option: Required
  - name: CURRENT_SHARD_LB_ADVERTISED_BUS_PORT
    valueFrom:
      serviceVarRef:
        name: redis-lb-advertised
        optional: true
        port:
          name: advertised-bus
          option: Required
  - name: ALL_SHARDS_COMPONENT_SHORT_NAMES
    valueFrom:
      componentVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          strategy: combined
        optional: false
        shortName: Required
  - name: ALL_SHARDS_POD_NAME_LIST
    valueFrom:
      componentVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          strategy: individual
        optional: false
        podNames: Required
  - name: ALL_SHARDS_POD_FQDN_LIST
    valueFrom:
      componentVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          strategy: individual
        optional: false
        podFQDNs: Required
  - name: ALL_SHARDS_ADVERTISED_PORT
    valueFrom:
      serviceVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: .
              keyValueDelimiter: '@'
            valueFormat: Flatten
          strategy: combined
        name: redis-advertised
        optional: true
        port:
          name: redis-advertised
          option: Required
  - name: ALL_SHARDS_LB_ADVERTISED_PORT
    valueFrom:
      serviceVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: .
              keyValueDelimiter: '@'
            valueFormat: Flatten
          strategy: combined
        name: redis-lb-advertised
        optional: true
        port:
          name: redis-advertised
          option: Required
  - name: ALL_SHARDS_LB_ADVERTISED_BUS_PORT
    valueFrom:
      serviceVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: .
              keyValueDelimiter: '@'
            valueFormat: Flatten
          strategy: combined
        name: redis-lb-advertised
        optional: true
        port:
          name: advertised-bus
          option: Required
  - name: ALL_SHARDS_LB_ADVERTISED_HOST
    valueFrom:
      serviceVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        host: Required
        loadBalancer: Required
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: ','
              keyValueDelimiter: '@'
            valueFormat: Flatten
          strategy: combined
        name: redis-lb-advertised
        optional: true
  - name: REDIS_CLUSTER_HOST_NETWORK_PORT
    valueFrom:
      hostNetworkVarRef:
        container:
          name: redis-cluster
          port:
            name: redis-cluster
            option: Required
        optional: true
  - expression: '{{if index . "REDIS_CLUSTER_HOST_NETWORK_PORT"}}{{.REDIS_CLUSTER_HOST_NETWORK_PORT}}{{else}}{{.SERVICE_PORT}}{{end}}'
    name: SERVICE_PORT
    value: "6379"
  - expression: '{{if eq (index . "TLS_ENABLED") "true"}}rediss://localhost: {{.SERVICE_PORT
      }}{{else}}redis://localhost:{{.SERVICE_PORT}}{{end}}'
    name: REDIS_METRICS_ADDR
    value: redis://localhost:$(SERVICE_PORT)
  - expression: '{{if eq (index . "TLS_ENABLED") "true"}}--tls --insecure{{else }}{{end}}'
    name: REDIS_CLI_TLS_CMD
    value: ""
  - name: REDIS_CLUSTER_HOST_NETWORK_BUS_PORT
    valueFrom:
      hostNetworkVarRef:
        container:
          name: redis-cluster
          port:
            name: cluster-bus
            option: Required
        optional: true
  - expression: '{{if index . "REDIS_CLUSTER_HOST_NETWORK_BUS_PORT"}}{{.REDIS_CLUSTER_HOST_NETWORK_BUS_PORT}}{{else}}{{.CLUSTER_BUS_PORT}}{{end}}'
    name: CLUSTER_BUS_PORT
    value: "16379"
  - name: REDIS_METRICS_HOST_NETWORK_PORT
    valueFrom:
      hostNetworkVarRef:
        container:
          name: metrics
          port:
            name: http-metrics
            option: Required
        optional: true
  - expression: '{{if index . "REDIS_METRICS_HOST_NETWORK_PORT"}}{{.REDIS_METRICS_HOST_NETWORK_PORT}}{{else}}{{.REDIS_METRICS_HTTP_PORT}}{{end}}'
    name: REDIS_METRICS_HTTP_PORT
    value: "9121"
  - name: REDIS_METRICS_HOST_NETWORK_SERVER_PORT
    valueFrom:
      hostNetworkVarRef:
        container:
          name: metrics
          port:
            name: server-metrics
            option: Required
        optional: true
  - expression: '{{if index . "REDIS_METRICS_HOST_NETWORK_SERVER_PORT"}}{{.REDIS_METRICS_HOST_NETWORK_SERVER_PORT}}{{else}}{{.REDIS_METRICS_SERVER_PORT}}{{end}}'
    name: REDIS_METRICS_SERVER_PORT
    value: "8888"
  - name: REDIS_CLUSTER_ALL_SHARDS_HOST_NETWORK_PORT
    valueFrom:
      hostNetworkVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        container:
          name: redis-cluster
          port:
            name: redis-cluster
            option: Required
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: ','
              keyValueDelimiter: ':'
            valueFormat: Flatten
          strategy: combined
        optional: true
  - name: REDIS_CLUSTER_ALL_SHARDS_HOST_NETWORK_BUS_PORT
    valueFrom:
      hostNetworkVarRef:
        compDef: redis-cluster-8-1.1.0-alpha.0
        container:
          name: redis-cluster
          port:
            name: cluster-bus
            option: Required
        multipleClusterObjectOption:
          combinedOption:
            flattenFormat:
              delimiter: ','
              keyValueDelimiter: ':'
            valueFormat: Flatten
          strategy: combined
        optional: true
  - name: PHY_MEMORY
    valueFrom:
      resourceVarRef:
        memoryLimit: Required
  volumes:
  - highWatermark: 0
    name: data
    needSnapshot: true
status:
  observedGeneration: 1
  phase: Available

[leon-ape]

Thanks. The KubeBlocks version and updated CRDs are now confirmed, but this reproduction still cannot confirm the reported revision issue.

The new Cluster manifest still references rediscl-cfwziv-shard-default, while the output confirms that this referenced Secret does not exist. No shard Component is created, so there is still no Component secretRefRevision to compare.

Please retry in a clean namespace with one of the following valid inputs:

• create a source Secret first and reference that existing Secret; or
• remove systemAccounts[].secretRef and let KubeBlocks generate the shared account Secret.

If the retry still fails, please provide only the resulting Cluster, shard Component, generated/shared Secret YAML (with values redacted), and the relevant controller logs.

[JashBook]

Thanks. The KubeBlocks version and updated CRDs are now confirmed, but this reproduction still cannot confirm the reported revision issue.

The new Cluster manifest still references rediscl-cfwziv-shard-default, while the output confirms that this referenced Secret does not exist. No shard Component is created, so there is still no Component secretRefRevision to compare.

Please retry in a clean namespace with one of the following valid inputs:

• create a source Secret first and reference that existing Secret; or
• remove systemAccounts[].secretRef and let KubeBlocks generate the shared account Secret.

If the retry still fails, please provide only the resulting Cluster, shard Component, generated/shared Secret YAML (with values redacted), and the relevant controller logs.

1. create remove systemAccounts[].secretRef

apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  name: rediscl-fxwzhb
  namespace: default
spec:
  clusterDef: redis
  topology: cluster
  terminationPolicy: DoNotTerminate
  services:
  - componentSelector: shard
    name: secondary
    serviceName:  shard-secondary
    roleSelector: secondary
    spec:
      ports:
        - name: redis-cluster
          port: 6379
          protocol: TCP
          targetPort: redis-cluster
  shardings:
  - name: shard
    shards: 3
    shardingDef: redis-cluster
    template:
      name: redis
      componentDef: redis-cluster-8-1.1.0-alpha.0
      serviceVersion: 8.0.1
      replicas: 2
      services:
      - name: redis-advertised
        serviceType: NodePort
        podService: true
      systemAccounts:
      - disabled: false
        name: default
      resources:
        limits:
          cpu: 100m
          memory: 0.5Gi
        requests:
          cpu: 100m
          memory: 0.5Gi
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      volumeClaimTemplates:
        - name: data
          spec:
            storageClassName: 
            accessModes:
              - ReadWriteOnce
            resources:
               requests:
                 storage: 20Gi

2. see error

kubectl get cluster rediscl-fxwzhb
NAME             CLUSTER-DEFINITION   TERMINATION-POLICY   STATUS     AGE
rediscl-fxwzhb   redis                DoNotTerminate       Creating   12m

kubectl get secret -l app.kubernetes.io/instance=rediscl-fxwzhb
NAME                                       TYPE     DATA   AGE
rediscl-fxwzhb-shard-default               Opaque   2      14m
rediscl-fxwzhb-shard-gpw-account-default   Opaque   2      14m
rediscl-fxwzhb-shard-p5d-account-default   Opaque   2      14m
rediscl-fxwzhb-shard-tdt-account-default   Opaque   2      14m

➜  ~ kubectl get cmp -l app.kubernetes.io/instance=rediscl-fxwzhb

NAME                       DEFINITION                      SERVICE-VERSION   STATUS   AGE
rediscl-fxwzhb-shard-gpw   redis-cluster-8-1.1.0-alpha.0   8.0.1                      12m
rediscl-fxwzhb-shard-p5d   redis-cluster-8-1.1.0-alpha.0   8.0.1                      12m
rediscl-fxwzhb-shard-tdt   redis-cluster-8-1.1.0-alpha.0   8.0.1                      12m
➜  ~ 
➜  ~ kubectl get pod -l app.kubernetes.io/instance=rediscl-fxwzhb 
NAME                         READY   STATUS    RESTARTS   AGE
rediscl-fxwzhb-shard-gpw-0   4/4     Running   0          12m
rediscl-fxwzhb-shard-gpw-1   4/4     Running   0          11m
rediscl-fxwzhb-shard-p5d-0   4/4     Running   0          12m
rediscl-fxwzhb-shard-p5d-1   4/4     Running   0          11m
rediscl-fxwzhb-shard-tdt-0   4/4     Running   0          12m
rediscl-fxwzhb-shard-tdt-1   4/4     Running   0          11m
➜  ~ 
➜  ~ kbcli cluster list-instances rediscl-fxwzhb
NAME                         NAMESPACE   CLUSTER          COMPONENT          STATUS    ROLE        ACCESSMODE   AZ               CPU(REQUEST/LIMIT)   MEMORY(REQUEST/LIMIT)   STORAGE     NODE                          CREATED-TIME                 
rediscl-fxwzhb-shard-gpw-0   default     rediscl-fxwzhb   shard(shard-gpw)   Running   primary                  cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.208/192.168.0.208   Aug 17,2026 11:10 UTC+0800   
rediscl-fxwzhb-shard-gpw-1   default     rediscl-fxwzhb   shard(shard-gpw)   Running   secondary                cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.209/192.168.0.209   Aug 17,2026 11:11 UTC+0800   
rediscl-fxwzhb-shard-p5d-0   default     rediscl-fxwzhb   shard(shard-p5d)   Running   primary                  cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.133/192.168.0.133   Aug 17,2026 11:10 UTC+0800   
rediscl-fxwzhb-shard-p5d-1   default     rediscl-fxwzhb   shard(shard-p5d)   Running   secondary                cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.208/192.168.0.208   Aug 17,2026 11:11 UTC+0800   
rediscl-fxwzhb-shard-tdt-0   default     rediscl-fxwzhb   shard(shard-tdt)   Running   primary                  cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.209/192.168.0.209   Aug 17,2026 11:10 UTC+0800   
rediscl-fxwzhb-shard-tdt-1   default     rediscl-fxwzhb   shard(shard-tdt)   Running   secondary                cn-guangzhou-b   100m / 100m          512Mi / 512Mi           data:20Gi   192.168.0.133/192.168.0.133   Aug 17,2026 11:11 UTC+0800 

3. get cluster and cmp yaml

kubectl get cluster rediscl-fxwzhb -oyaml
apiVersion: apps.kubeblocks.io/v1
kind: Cluster
metadata:
  annotations:
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps.kubeblocks.io/v1","kind":"Cluster","metadata":{"annotations":{},"name":"rediscl-fxwzhb","namespace":"default"},"spec":{"clusterDef":"redis","services":[{"componentSelector":"shard","name":"secondary","roleSelector":"secondary","serviceName":"shard-secondary","spec":{"ports":[{"name":"redis-cluster","port":6379,"protocol":"TCP","targetPort":"redis-cluster"}]}}],"shardings":[{"name":"shard","shardingDef":"redis-cluster","shards":3,"template":{"componentDef":"redis-cluster-8-1.1.0-alpha.0","name":"redis","persistentVolumeClaimRetentionPolicy":{"whenDeleted":"Delete"},"replicas":2,"resources":{"limits":{"cpu":"100m","memory":"0.5Gi"},"requests":{"cpu":"100m","memory":"0.5Gi"}},"serviceVersion":"8.0.1","services":[{"name":"redis-advertised","podService":true,"serviceType":"NodePort"}],"systemAccounts":[{"disabled":false,"name":"default"}],"volumeClaimTemplates":[{"name":"data","spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"20Gi"}},"storageClassName":null}}]}}],"terminationPolicy":"DoNotTerminate","topology":"cluster"}}
  creationTimestamp: "2026-08-17T03:10:55Z"
  finalizers:
  - cluster.kubeblocks.io/finalizer
  generation: 13085
  labels:
    clusterdefinition.kubeblocks.io/name: redis
  name: rediscl-fxwzhb
  namespace: default
  resourceVersion: "269469209"
  uid: 4812bfaf-1b5e-4209-86c1-38b42a76f0e3
spec:
  clusterDef: redis
  services:
  - componentSelector: shard
    name: secondary
    roleSelector: secondary
    serviceName: shard-secondary
    spec:
      ports:
      - name: redis-cluster
        port: 6379
        protocol: TCP
        targetPort: redis-cluster
  shardings:
  - name: shard
    shardingDef: redis-cluster
    shards: 3
    template:
      componentDef: redis-cluster-8-1.1.0-alpha.0
      flatInstanceOrdinal: false
      name: redis
      ordinals: {}
      persistentVolumeClaimRetentionPolicy:
        whenDeleted: Delete
      podUpdatePolicy: PreferInPlace
      replicas: 2
      resources:
        limits:
          cpu: 100m
          memory: 512Mi
        requests:
          cpu: 100m
          memory: 512Mi
      serviceVersion: 8.0.1
      services:
      - name: redis-advertised
        podService: true
        serviceType: NodePort
      systemAccounts:
      - disabled: false
        name: default
        secretRef:
          name: rediscl-fxwzhb-shard-default
          namespace: default
          password: password
        secretRefRevision: f39314a8af1b669833bf8db97bff9b7091d93b0fdd9c0df1ee10dfee8cd32e43
      volumeClaimTemplates:
      - name: data
        spec:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi
  terminationPolicy: DoNotTerminate
  topology: cluster
status:
  conditions:
  - lastTransitionTime: "2026-08-17T03:10:55Z"
    message: 'The operator has started the provisioning of Cluster: rediscl-fxwzhb'
    observedGeneration: 13084
    reason: PreCheckSucceed
    status: "True"
    type: ProvisioningStarted
  - lastTransitionTime: "2026-08-17T03:10:55Z"
    message: 'component rediscl-fxwzhb-shard-p5d of sharding shard has no available
      condition; component rediscl-fxwzhb-shard-gpw of sharding shard has no available
      condition; component rediscl-fxwzhb-shard-tdt of sharding shard has no available
      condition; '
    reason: Unavailable
    status: "False"
    type: Available
  - lastTransitionTime: "2026-08-17T03:23:48Z"
    message: Successfully applied for resources
    observedGeneration: 13084
    reason: ApplyResourcesSucceed
    status: "True"
    type: ApplyResources
  observedGeneration: 13083
  phase: Creating
  shardings:
    shard:
      observedGeneration: 13083
      phase: Creating
      postProvision:
        completionTime: "2026-08-17T03:10:55Z"
        message: the PostProvision action is not defined
        phase: Skipped
        startTime: "2026-08-17T03:10:55Z"
      shardingDef: redis-cluster

kubectl get cmp rediscl-fxwzhb-shard-p5d -oyaml
apiVersion: apps.kubeblocks.io/v1
kind: Component
metadata:
  annotations:
    apps.kubeblocks.io/cluster-uid: 4812bfaf-1b5e-4209-86c1-38b42a76f0e3
    kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
    kubeblocks.io/generation: "13277"
  creationTimestamp: "2026-08-17T03:10:55Z"
  finalizers:
  - cluster.kubeblocks.io/finalizer
  - component.kubeblocks.io/finalizer
  generation: 13305
  labels:
    app.kubernetes.io/component: redis-cluster-8-1.1.0-alpha.0
    app.kubernetes.io/instance: rediscl-fxwzhb
    app.kubernetes.io/managed-by: kubeblocks
    apps.kubeblocks.io/component-name: shard-p5d
    apps.kubeblocks.io/sharding-name: shard
    componentdefinition.kubeblocks.io/name: redis-cluster-8-1.1.0-alpha.0
  name: rediscl-fxwzhb-shard-p5d
  namespace: default
  ownerReferences:
  - apiVersion: apps.kubeblocks.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Cluster
    name: rediscl-fxwzhb
    uid: 4812bfaf-1b5e-4209-86c1-38b42a76f0e3
  resourceVersion: "269470653"
  uid: ba4e39f0-14ed-4ce9-ad16-3ce6b50a96b9
spec:
  compDef: redis-cluster-8-1.1.0-alpha.0
  configs:
  - configMap:
      name: rediscl-fxwzhb-shard-p5d-redis-cluster-config
    name: redis-cluster-config
  customActions:
  - action:
      exec:
        command:
        - /bin/bash
        - -c
        - |
          if [ "$LEGACY_REDIS" == "true" ]; then
             /scripts/redis-cluster6-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
          else
             /scripts/redis-cluster-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
          fi
        container: redis-cluster
      retryPolicy:
        maxRetries: 10
        retryInterval: 0
      timeoutSeconds: 600
    name: shardingShardRemove
  flatInstanceOrdinal: false
  ordinals: {}
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Delete
  podUpdatePolicy: PreferInPlace
  replicas: 2
  resources:
    limits:
      cpu: 100m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 512Mi
  serviceVersion: 8.0.1
  services:
  - name: redis-advertised
    podService: true
    spec:
      type: NodePort
  systemAccounts:
  - disabled: false
    name: default
    secretRef:
      name: rediscl-fxwzhb-shard-default
      namespace: default
      password: password
    secretRefRevision: 4c774e014723d155053886c410fc048a5e1f86a153893a555544a5b552497f5c
  terminationPolicy: DoNotTerminate
  volumeClaimTemplates:
  - name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 20Gi
status:
  conditions:
  - lastTransitionTime: "2026-08-17T03:10:56Z"
    message: 'The operator has started the provisioning of Cluster: rediscl-fxwzhb-shard-p5d'
    observedGeneration: 9675
    reason: PreCheckSucceed
    status: "True"
    type: ProvisioningStarted

describe cmp

kubectl describe cmp rediscl-fxwzhb-shard-gpw
Name:         rediscl-fxwzhb-shard-gpw
Namespace:    default
Labels:       app.kubernetes.io/component=redis-cluster-8-1.1.0-alpha.0
              app.kubernetes.io/instance=rediscl-fxwzhb
              app.kubernetes.io/managed-by=kubeblocks
              apps.kubeblocks.io/component-name=shard-gpw
              apps.kubeblocks.io/sharding-name=shard
              componentdefinition.kubeblocks.io/name=redis-cluster-8-1.1.0-alpha.0
Annotations:  apps.kubeblocks.io/cluster-uid: 4812bfaf-1b5e-4209-86c1-38b42a76f0e3
              kubeblocks.io/crd-api-version: apps.kubeblocks.io/v1
              kubeblocks.io/generation: 15090
API Version:  apps.kubeblocks.io/v1
Kind:         Component
Metadata:
  Creation Timestamp:  2026-08-17T03:10:55Z
  Finalizers:
    cluster.kubeblocks.io/finalizer
    component.kubeblocks.io/finalizer
  Generation:  15114
  Owner References:
    API Version:           apps.kubeblocks.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Cluster
    Name:                  rediscl-fxwzhb
    UID:                   4812bfaf-1b5e-4209-86c1-38b42a76f0e3
  Resource Version:        269484385
  UID:                     d34b9bbf-492f-46c8-a0d3-1f60038cab7a
Spec:
  Comp Def:  redis-cluster-8-1.1.0-alpha.0
  Configs:
    Config Map:
      Name:  rediscl-fxwzhb-shard-gpw-redis-cluster-config
    Name:    redis-cluster-config
  Custom Actions:
    Action:
      Exec:
        Command:
          /bin/bash
          -c
          if [ "$LEGACY_REDIS" == "true" ]; then
   /scripts/redis-cluster6-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
else
   /scripts/redis-cluster-manage.sh --pre-terminate > /tmp/pre-terminate.log 2>&1
fi

        Container:  redis-cluster
      Retry Policy:
        Max Retries:      10
        Retry Interval:   0
      Timeout Seconds:    600
    Name:                 shardingShardRemove
  Flat Instance Ordinal:  false
  Ordinals:
  Persistent Volume Claim Retention Policy:
    When Deleted:     Delete
  Pod Update Policy:  PreferInPlace
  Replicas:           2
  Resources:
    Limits:
      Cpu:     100m
      Memory:  512Mi
    Requests:
      Cpu:          100m
      Memory:       512Mi
  Service Version:  8.0.1
  Services:
    Name:         redis-advertised
    Pod Service:  true
    Spec:
      Type:  NodePort
  System Accounts:
    Disabled:  false
    Name:      default
    Secret Ref:
      Name:               rediscl-fxwzhb-shard-default
      Namespace:          default
      Password:           password
    Secret Ref Revision:  f70326e031a55c6eab567096dd7f845e9641f13761eac919f4015c4332d2c99e
  Termination Policy:     DoNotTerminate
  Volume Claim Templates:
    Name:  data
    Spec:
      Access Modes:
        ReadWriteOnce
      Resources:
        Requests:
          Storage:  20Gi
Status:
  Conditions:
    Last Transition Time:  2026-08-17T03:10:57Z
    Message:               The operator has started the provisioning of Cluster: rediscl-fxwzhb-shard-gpw
    Observed Generation:   11891
    Reason:                PreCheckSucceed
    Status:                True
    Type:                  ProvisioningStarted
Events:
  Type    Reason                    Age                From                  Message
  ----    ------                    ----               ----                  -------
  Normal  WorkloadNotUpdated        14m (x2 over 14m)  component-controller  observed workload's generation not matching component's
  Normal  PhaseCheckFail            14m (x6 over 14m)  component-controller  the component phase is Creating
  Normal  WorkloadNotReady          14m (x6 over 14m)  component-controller  some instances are not ready
  Normal  ComponentPhaseTransition  14m (x7 over 14m)  component-controller  component is Creating

kubeblocks logs

2026-08-17T03:14:58.620Z	INFO	build error: requeue to waiting for post-provision annotation to be set	{"controller": "component", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Component", "Component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}, "namespace": "default", "name": "rediscl-fxwzhb-shard-tdt", "reconcileID": "d50b7b5b-69ad-4fc4-88f7-e69f31af70c9", "component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}}
2026-08-17T03:14:58.636Z	INFO	reconcile object *v1.InstanceSet with action UPDATE OK	{"controller": "component", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Component", "Component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}, "namespace": "default", "name": "rediscl-fxwzhb-shard-tdt", "reconcileID": "d50b7b5b-69ad-4fc4-88f7-e69f31af70c9", "component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}}
2026-08-17T03:14:58.643Z	INFO	execute error: Operation cannot be fulfilled on components.apps.kubeblocks.io "rediscl-fxwzhb-shard-tdt": the object has been modified; please apply your changes to the latest version and try again	{"controller": "component", "controllerGroup": "apps.kubeblocks.io", "controllerKind": "Component", "Component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}, "namespace": "default", "name": "rediscl-fxwzhb-shard-tdt", "reconcileID": "d50b7b5b-69ad-4fc4-88f7-e69f31af70c9", "component": {"name":"rediscl-fxwzhb-shard-tdt","namespace":"default"}}
2026-08-17T03:14:58.836Z	INFO	expected cm object[default/sidecar-redis-reload-tools-script-rediscl-fxwzhb] has been unchanged
2026-08-17T03:15:00.406Z	INFO	role probe event processed	{"controller": "event", "controllerGroup": "", "controllerKind": "Event", "Event": {"name":"rediscl-fxwzhb-shard-p5d-1.e76b20","namespace":"default"}, "namespace": "default", "name": "rediscl-fxwzhb-shard-p5d-1.e76b20", "reconcileID": "9805e8b7-3cd3-46ee-811e-d0d437fea8e5", "event": {"name":"rediscl-fxwzhb-shard-p5d-1.e76b20","namespace":"default"}, "eventName": "default/rediscl-fxwzhb-shard-p5d-1.e76b20", "eventUID": "9357cbac-08e4-4f4c-ae49-f9c5788bfc5d", "eventPodUID": "5793cad1-4677-43e6-bd99-0e2c2be3e3e8", "podName": "default/rediscl-fxwzhb-shard-p5d-1", "podUID": "5793cad1-4677-43e6-bd99-0e2c2be3e3e8", "role": "secondary", "eventVersion": "1786936500376900", "branch": "instanceset", "result": "handled", "reason": "updated", "workload": "rediscl-fxwzhb-shard-p5d", "previousRole": "secondary", "roleDefined": true, "handled": true, "exclusiveClean": false}