{"record":{"id":"3dbfdc54c30867dd","repo":"istio/istio","slug":"no-q-data-found","errorCode":null,"errorMessage":"no %q data found","messagePattern":"no %q data found","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/multicluster/remote_secret.go","lineNumber":216,"sourceCode":"\tauthProviderConfig *api.AuthProviderConfig,\n) (*v1.Secret, error) {\n\tcaData, ok := tokenSecret.Data[v1.ServiceAccountRootCAKey]\n\tif !ok {\n\t\treturn nil, errMissingRootCAKey\n\t}\n\n\t// Create a Kubeconfig to access the remote cluster using the auth provider plugin.\n\tkubeconfig := createPluginKubeconfig(caData, clusterName, server, tlsServerName, authProviderConfig)\n\tif err := clientcmd.Validate(*kubeconfig); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid kubeconfig: %v\", err)\n\t}\n\n\t// Encode the Kubeconfig in a secret that can be loaded by Istio to dynamically discover and access the remote cluster.\n\treturn createRemoteServiceAccountSecret(kubeconfig, clusterName, secName)\n}\n\nvar (\n\terrMissingRootCAKey = fmt.Errorf(\"no %q data found\", v1.ServiceAccountRootCAKey)\n\terrMissingTokenKey  = fmt.Errorf(\"no %q data found\", v1.ServiceAccountTokenKey)\n)\n\nfunc createRemoteSecretFromTokenAndServer(\n\tclient kube.CLIClient, tokenSecret *v1.Secret, clusterName, server, tlsServerName, secName string,\n) (*v1.Secret, error) {\n\tcaData, token, err := waitForTokenData(client, tokenSecret)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Create a Kubeconfig to access the remote cluster using the remote service account credentials.\n\tkubeconfig := createBearerTokenKubeconfig(caData, token, clusterName, server, tlsServerName)\n\tif err := clientcmd.Validate(*kubeconfig); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid kubeconfig: %v\", err)\n\t}\n\n\t// Encode the Kubeconfig in a secret that can be loaded by Istio to dynamically discover and access the remote cluster.","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/multicluster/remote_secret.go#L198-L234","documentation":"The sentinel errMissingRootCAKey in istioctl/pkg/multicluster/remote_secret.go: the token secret passed to createRemoteSecretFromPlugin does not contain the 'ca.crt' key (v1.ServiceAccountRootCAKey). It is thrown by tokenDataFromSecret when the secret exists but its Data map lacks the root CA entry.","triggerScenarios":"The service-account token secret referenced (found by listing, by --secret-name, or just created) has no Data[\"ca.crt\"] — either it is not really a kubernetes.io/service-account-token secret, or the API server has not yet populated the projected keys.","commonSituations":"Race right after secret creation where kube-controller-manager has not stamped ca.crt/token yet (the code has waitForTokenData for the bearer path but the plugin path reads directly); pointing --secret-name at an opaque/TLS secret; k8s 1.24+ where legacy auto-generated SA secrets no longer exist; secret created from a manifest without the token controller.","solutions":["Inspect the secret: `kubectl get secret <name> -o jsonpath='{.data}'` — confirm ca.crt exists.","If keys are missing, delete the manually created token secret and let the tool recreate it, then retry.","On k8s >= 1.24, create a projected token via `kubectl create token` or a TokenRequest, or use a secret manifest of type kubernetes.io/service-account-token with the kubernetes.io/service-account.name annotation.","Point --secret-name at a genuine service-account-token secret."],"exampleFix":"# before: secret exists but is opaque\ntype: Opaque\n\n# after: properly typed SA token secret the tool can read\napiVersion: v1\nkind: Secret\nmetadata:\n  name: istio-reader-istio-remote-secret-token\n  annotations:\n    kubernetes.io/service-account.name: istio-reader\ntype: kubernetes.io/service-account-token","handlingStrategy":"validation","validationCode":"// Check the required keys before handing the secret to the plugin path\nfunc hasRootCA(secret *corev1.Secret) bool {\n    d, ok := secret.Data[corev1.ServiceAccountRootCAKey]\n    return ok && len(d) > 0\n}\nif !hasRootCA(tokenSecret) {\n    return nil, fmt.Errorf(\"secret %s lacks %s; wait for token controller or use a projected token\",\n        tokenSecret.Name, corev1.ServiceAccountRootCAKey)\n}","typeGuard":"func isMissingRootCA(err error) bool {\n    return err != nil && strings.Contains(err.Error(),\n        fmt.Sprintf(\"no %q data found\", corev1.ServiceAccountRootCAKey))\n}","tryCatchPattern":"caData, err := tokenDataFromSecret(secret)\nif err != nil {\n    if isMissingRootCA(err) {\n        // poll like waitForTokenData does for the bearer path\n        time.Sleep(2 * time.Second)\n        caData, err = tokenDataFromSecret(secret)\n    }\n    if err != nil {\n        return nil, err\n    }\n}","preventionTips":["Only reference secrets of type kubernetes.io/service-account-token.","Right after creating a token secret, poll for both ca.crt and token keys before use.","On k8s >= 1.24 mint tokens via TokenRequest instead of expecting auto-populated secrets."],"tags":["kubernetes","secret","service-account","race-condition","multicluster"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}