{"record":{"id":"181101e00e666c1e","repo":"istio/istio","slug":"failed-to-create-credential-fetcher-v","errorCode":null,"errorMessage":"failed to create credential fetcher: %v","messagePattern":"failed to create credential fetcher: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/cmd/pilot-agent/options/security.go","lineNumber":102,"sourceCode":"\tcase jwt.PolicyFirstParty:\n\t\tlog.Warnf(\"Using deprecated JWT policy 'first-party-jwt'; treating as 'third-party-jwt'\")\n\t\tjwtPath = constants.ThirdPartyJwtPath\n\tdefault:\n\t\tlog.Info(\"Using existing certs\")\n\t}\n\n\to := secOpt\n\n\t// If not set explicitly, default to the discovery address.\n\tif o.CAEndpoint == \"\" {\n\t\to.CAEndpoint = proxyConfig.DiscoveryAddress\n\t\to.CAEndpointSAN = istiodSAN.Get()\n\t}\n\n\to.CredIdentityProvider = credIdentityProvider\n\tcredFetcher, err := credentialfetcher.NewCredFetcher(credFetcherTypeEnv, o.TrustDomain, jwtPath, o.CredIdentityProvider)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create credential fetcher: %v\", err)\n\t}\n\tlog.Infof(\"using credential fetcher of %s type in %s trust domain\", credFetcherTypeEnv, o.TrustDomain)\n\to.CredFetcher = credFetcher\n\n\tif o.CAProviderName == security.GkeWorkloadCertificateProvider {\n\t\tif !security.CheckWorkloadCertificate(security.GkeWorkloadCertChainFilePath,\n\t\t\tsecurity.GkeWorkloadKeyFilePath, security.GkeWorkloadRootCertFilePath) {\n\t\t\treturn nil, fmt.Errorf(\"GKE workload certificate files (%v, %v, %v) not present\",\n\t\t\t\tsecurity.GkeWorkloadCertChainFilePath, security.GkeWorkloadKeyFilePath, security.GkeWorkloadRootCertFilePath)\n\t\t}\n\t\tif o.ProvCert != \"\" {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"invalid options: PROV_CERT and FILE_MOUNTED_CERTS of GKE workload cert are mutually exclusive\")\n\t\t}\n\t\to.FileMountedCerts = true\n\t\to.CertChainFilePath = security.GkeWorkloadCertChainFilePath\n\t\to.KeyFilePath = security.GkeWorkloadKeyFilePath\n\t\to.RootCertFilePath = security.GkeWorkloadRootCertFilePath","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/cmd/pilot-agent/options/security.go#L84-L120","documentation":"Error \"failed to create credential fetcher: %v\" thrown in istio/istio.","triggerScenarios":"Thrown at pilot/cmd/pilot-agent/options/security.go:102 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}