{"record":{"id":"242b38fee12e2808","repo":"grpc/grpc-go","slug":"upstreamtlscontext-in-cds-response-does-not-contai","errorCode":null,"errorMessage":"UpstreamTlsContext in CDS response does not contain a CommonTlsContext","messagePattern":"UpstreamTlsContext in CDS response does not contain a CommonTlsContext","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/xdsclient/xdsresource/unmarshal_cds.go","lineNumber":367,"sourceCode":"\t\ttc = ts.GetTypedConfig()\n\t\ttypeURL = tc.GetTypeUrl()\n\t}\n\n\tif name := ts.GetName(); name != transportSocketName {\n\t\treturn nil, false, fmt.Errorf(\"transport_socket field has unexpected name: %s\", name)\n\t}\n\tif typeURL != version.V3UpstreamTLSContextURL {\n\t\treturn nil, false, fmt.Errorf(\"transport_socket missing typed_config or wrong type_url: %q\", typeURL)\n\t}\n\tupstreamCtx := &v3tlspb.UpstreamTlsContext{}\n\tif err := proto.Unmarshal(tc.GetValue(), upstreamCtx); err != nil {\n\t\treturn nil, false, fmt.Errorf(\"failed to unmarshal UpstreamTlsContext in CDS response: %v\", err)\n\t}\n\t// The following fields from `UpstreamTlsContext` are ignored:\n\t// - allow_renegotiation\n\t// - max_session_keys\n\tif upstreamCtx.GetCommonTlsContext() == nil {\n\t\treturn nil, false, errors.New(\"UpstreamTlsContext in CDS response does not contain a CommonTlsContext\")\n\t}\n\n\tsc, err := securityConfigFromCommonTLSContext(upstreamCtx.GetCommonTlsContext(), false)\n\tif err != nil {\n\t\treturn nil, false, err\n\t}\n\t// Set SNI related fields in SecurityConfig from UpstreamTlsContext if\n\t// `GRPC_EXPERIMENTAL_XDS_SNI` is enabled.\n\tif envconfig.XDSSNIEnabled {\n\t\tsc.SNI = upstreamCtx.GetSni()\n\t\tif len(sc.SNI) > maxSNILength {\n\t\t\treturn nil, false, fmt.Errorf(\"SNI value %q in UpstreamTlsContext in CDS response exceeds max length of %d\", sc.SNI, maxSNILength)\n\t\t}\n\t\tsc.UseAutoHostSNI = upstreamCtx.GetAutoHostSni()\n\t\tsc.AutoSNISANValidation = upstreamCtx.GetAutoSniSanValidation()\n\t}\n\treturn sc, isHTTP11ProxyEnabled, nil\n}","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L349-L385","documentation":"Returned when unmarshalling a cluster's UpstreamTlsContext (unmarshal_cds.go:366-367) if the typed config parses but its common_tls_context field is nil. The CDS security handler requires a CommonTlsContext to derive a SecurityConfig; without it there is nothing to configure mTLS from, so the cluster resource is rejected (NACK).","triggerScenarios":"A CDS response provides a transport_socket with typed_config UpstreamTlsContext, but the UpstreamTlsContext message has no common_tls_context populated. The nil check at line 366 fires.","commonSituations":"Control plane sends a partial/incomplete UpstreamTlsContext (e.g. only sni set, no common_tls_context); a templating bug in the xDS server; a malformed bootstrap or test fixture.","solutions":["Fix the xDS server/fixture so UpstreamTlsContext.common_tls_context is populated with a valid CommonTlsContext (tls_certificate_certificate_provider / validation_context).","If mTLS is not intended for that cluster, remove the transport_socket/UpstreamTlsContext entirely so no security block is parsed.","Inspect the raw cluster resource and confirm common_tls_context is present and non-empty."],"exampleFix":"// before\n//   upstream_tls_context: { sni: \"svc.example\" }   // missing common_tls_context\n// after\n//   upstream_tls_context: {\n//     common_tls_context: {\n//       tls_certificate_certificate_provider_instance: { instance_name: \"default\", certificate_name: \"default\" },\n//       validation_context: { ... }\n//     }\n//   }","handlingStrategy":"validation","validationCode":"func upstreamTLSHasCommonCtx(uts *v3tlspb.UpstreamTlsContext) bool {\n    return uts != nil && uts.GetCommonTlsContext() != nil\n}","typeGuard":"func isCompleteUpstreamTLS(uts *v3tlspb.UpstreamTlsContext) bool {\n    return upstreamTLSHasCommonCtx(uts)\n}","tryCatchPattern":null,"preventionTips":["Always set common_tls_context when configuring an UpstreamTlsContext for gRPC.","If no mTLS is needed, omit the transport_socket entirely.","Validate cluster security config with a fixture test before publishing."],"tags":["xds","cds","tls","mtls","config","security"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}