diff --git a/apis/apps/v2beta1/emqx_types.go b/apis/apps/v2beta1/emqx_types.go
index 0c7737c83..496859125 100644
--- a/apis/apps/v2beta1/emqx_types.go
+++ b/apis/apps/v2beta1/emqx_types.go
@@ -108,8 +108,8 @@ type BootstrapAPIKey struct {
 }
 
 type SecretRef struct {
-	Key    *KeyRef `json:"key"`
-	Secret *KeyRef `json:"secret"`
+	Key    KeyRef `json:"key"`
+	Secret KeyRef `json:"secret"`
 }
 
 type KeyRef struct {
diff --git a/apis/apps/v2beta1/zz_generated.deepcopy.go b/apis/apps/v2beta1/zz_generated.deepcopy.go
index d140d3bda..524169422 100644
--- a/apis/apps/v2beta1/zz_generated.deepcopy.go
+++ b/apis/apps/v2beta1/zz_generated.deepcopy.go
@@ -33,7 +33,7 @@ func (in *BootstrapAPIKey) DeepCopyInto(out *BootstrapAPIKey) {
 	if in.SecretRef != nil {
 		in, out := &in.SecretRef, &out.SecretRef
 		*out = new(SecretRef)
-		(*in).DeepCopyInto(*out)
+		**out = **in
 	}
 }
 
@@ -688,16 +688,8 @@ func (in *RebalanceStrategy) DeepCopy() *RebalanceStrategy {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SecretRef) DeepCopyInto(out *SecretRef) {
 	*out = *in
-	if in.Key != nil {
-		in, out := &in.Key, &out.Key
-		*out = new(KeyRef)
-		**out = **in
-	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(KeyRef)
-		**out = **in
-	}
+	out.Key = in.Key
+	out.Secret = in.Secret
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretRef.
diff --git a/controllers/apps/v2beta1/add_bootstrap_resource.go b/controllers/apps/v2beta1/add_bootstrap_resource.go
index 75e6164d6..787e0372f 100644
--- a/controllers/apps/v2beta1/add_bootstrap_resource.go
+++ b/controllers/apps/v2beta1/add_bootstrap_resource.go
@@ -10,6 +10,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	appsv2beta1 "github.com/emqx/emqx-operator/apis/apps/v2beta1"
 	innerReq "github.com/emqx/emqx-operator/internal/requester"
@@ -87,17 +88,22 @@ func ReadSecret(k8sClient client.Client, ctx context.Context, namespace string,
 }
 
 func generateBootstrapAPIKeySecret(k8sClient client.Client, ctx context.Context, instance *appsv2beta1.EMQX) *corev1.Secret {
+	logger := log.FromContext(ctx)
 	bootstrapAPIKeys := ""
 
 	for _, apiKey := range instance.Spec.BootstrapAPIKeys {
 		if apiKey.SecretRef != nil {
+			logger.V(1).Info("Read SecretRef")
+
 			// Read key and secret values from the refenced secrets
 			keyValue, err := ReadSecret(k8sClient, ctx, instance.Namespace, apiKey.SecretRef.Key.SecretName, apiKey.SecretRef.Key.SecretKey)
 			if err != nil {
+				logger.V(1).Error(err, "read secretRef", "key")
 				continue
 			}
 			secretValue, err := ReadSecret(k8sClient, ctx, instance.Namespace, apiKey.SecretRef.Secret.SecretName, apiKey.SecretRef.Secret.SecretKey)
 			if err != nil {
+				logger.V(1).Error(err, "read secretRef", "secret")
 				continue
 			}
 			bootstrapAPIKeys += keyValue + ":" + secretValue + "\n"
diff --git a/controllers/apps/v2beta1/add_bootstrap_resource_suite_test.go b/controllers/apps/v2beta1/add_bootstrap_resource_suite_test.go
index f66cefd81..f538c4bcf 100644
--- a/controllers/apps/v2beta1/add_bootstrap_resource_suite_test.go
+++ b/controllers/apps/v2beta1/add_bootstrap_resource_suite_test.go
@@ -113,12 +113,12 @@ var _ = Describe("AddBootstrap", Ordered, Label("bootstrap"), func() {
 		instance.Spec.BootstrapAPIKeys = []appsv2beta1.BootstrapAPIKey{
 			{
 				SecretRef: &appsv2beta1.SecretRef{
-					Key: &appsv2beta1.KeyRef{
+					Key: appsv2beta1.KeyRef{
 						// Note: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters
 						SecretName: "test-key-secret",
 						SecretKey:  "key",
 					},
-					Secret: &appsv2beta1.KeyRef{
+					Secret: appsv2beta1.KeyRef{
 						SecretName: "test-value-secret",
 						SecretKey:  "secret",
 					},
diff --git a/controllers/apps/v2beta1/add_bootstrap_resource_test.go b/controllers/apps/v2beta1/add_bootstrap_resource_test.go
index 51647f07e..76d1dc951 100644
--- a/controllers/apps/v2beta1/add_bootstrap_resource_test.go
+++ b/controllers/apps/v2beta1/add_bootstrap_resource_test.go
@@ -133,11 +133,11 @@ func TestGenerateBootstrapAPIKeySecretWithSecretRef(t *testing.T) {
 			BootstrapAPIKeys: []appsv2beta1.BootstrapAPIKey{
 				{
 					SecretRef: &appsv2beta1.SecretRef{
-						Key: &appsv2beta1.KeyRef{
+						Key: appsv2beta1.KeyRef{
 							SecretName: "test-key-secret",
 							SecretKey:  "key",
 						},
-						Secret: &appsv2beta1.KeyRef{
+						Secret: appsv2beta1.KeyRef{
 							SecretName: "test-value-secret",
 							SecretKey:  "secret",
 						},
diff --git a/docs/en_US/reference/v2beta1-reference.md b/docs/en_US/reference/v2beta1-reference.md
index f8a64c501..62b1170a4 100644
--- a/docs/en_US/reference/v2beta1-reference.md
+++ b/docs/en_US/reference/v2beta1-reference.md
@@ -297,6 +297,10 @@ _Appears in:_
 _Appears in:_
 - [SecretRef](#secretref)
 
+| Field | Description |
+| --- | --- |
+| `secretName` _string_ |  |
+| `secretKey` _string_ |  |
 
 
 #### NodeEvacuationStats
diff --git a/docs/zh_CN/reference/v2beta1-reference.md b/docs/zh_CN/reference/v2beta1-reference.md
index f8a64c501..62b1170a4 100644
--- a/docs/zh_CN/reference/v2beta1-reference.md
+++ b/docs/zh_CN/reference/v2beta1-reference.md
@@ -297,6 +297,10 @@ _Appears in:_
 _Appears in:_
 - [SecretRef](#secretref)
 
+| Field | Description |
+| --- | --- |
+| `secretName` _string_ |  |
+| `secretKey` _string_ |  |
 
 
 #### NodeEvacuationStats