apache/shenyu · error · ShenyuException

Decrement when domain ssl counts <= 0, an unknown exception…

Q: What causes "Decrement when domain ssl counts <= 0, an unknown exception has occurred." in apache/shenyu?

Audit the increment/decrement call sites so every decrement is paired with exactly one prior increment

Error message

Decrement when domain ssl counts <= 0, an unknown exception has occurred.

What it means

IngressSecretCache.getAndDecrementDomainNums decrements the reference count of domains using an SSL secret. If the count is already <= 0 there is nothing to decrement, indicating the internal bookkeeping is out of sync (decrement without a matching increment), so it throws ShenyuException. This is an internal invariant violation in the k8s controller cache.

Solutions

Audit the increment/decrement call sites so every decrement is paired with exactly one prior increment
Reset/rebuild the cache from current Ingress/Secret state (controller restart) to resync counts
Log the domain and map state when this occurs and skip the decrement instead of crashing reconciliation
Check for duplicate or out-of-order k8s event handling in the controller

Example fix

// before
if (count.intValue() > 0) { return count.getAndDecrement(); }
// defensively, callers should check first:
// after
if (cache.getDomainNums(domain) > 0) { cache.getAndDecrementDomainNums(domain); }

Defensive patterns

Strategy: validation

Validate before calling

if (cache.getDomainNums(domain) > 0) {
    cache.getAndDecrementDomainNums(domain);
}

Try / catch

try {
    cache.getAndDecrementDomainNums(domain);
} catch (ShenyuException e) {
    log.warn("decrement underflow for domain {} - rebuilding cache", domain, e);
    cache.rebuildFromClusterState();
}

Prevention

Pair every increment with exactly one decrement
Handle k8s delete events idempotently
Rebuild counts from cluster state on controller restart
Log map state on underflow to diagnose event ordering

When it happens

Trigger: Calling getAndDecrementDomainNums(domain) when DOMAIN_NUMS_MAP has no positive count for that domain — e.g. delete/reconcile events arriving out of order, or double removal of a domain reference.

Common situations: Kubernetes events processed concurrently or re-delivered, an Ingress delete handled twice, a bug in increment pairing after controller restarts with a warm map.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/86613a5fd0477d5a. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/cache/IngressSecretCache.java:118

     * @return the previous number of the ingress that enables the domain name to take effect
     */
    public Integer getAndIncrementDomainNums(final String domain) {
        AtomicInteger count = DOMAIN_NUMS_MAP.computeIfAbsent(domain, k -> new AtomicInteger(0));
        return count.getAndIncrement();
    }

    /**
     * Get and decrement the number of the ingress that enables the domain name to take effect.
     *
     * @param domain tls domain
     * @return the previous number of the ingress that enables the domain name to take effect
     */
    public Integer getAndDecrementDomainNums(final String domain) {
        AtomicInteger count = DOMAIN_NUMS_MAP.computeIfAbsent(domain, k -> new AtomicInteger(0));
        if (count.intValue() > 0) {
            return count.getAndDecrement();
        }
        throw new ShenyuException("Decrement when domain ssl counts <= 0, an unknown exception has occurred.");
    }

    private String getKey(final String namespace, final String name) {
        return namespace + "-" + name;
    }
}

View on GitHub (pinned to 567142e072)