{"record":{"id":"5a3134fda1eaabb9","repo":"istio/istio","slug":"private-key-provider-configuration-is-required","errorCode":null,"errorMessage":"private key provider configuration is required","messagePattern":"private key provider configuration is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/validation/agent/validation.go","lineNumber":471,"sourceCode":"\t\tif err := validateConnectionSettings(cs); err != nil {\n\t\t\terrs = multierror.Append(errs, multierror.Prefix(err, \"invalid connection settings:\"))\n\t\t}\n\t}\n\n\treturn Validation{errs, warnings}\n}\n\nfunc ValidateControlPlaneAuthPolicy(policy meshconfig.AuthenticationPolicy) error {\n\tif policy == meshconfig.AuthenticationPolicy_NONE || policy == meshconfig.AuthenticationPolicy_MUTUAL_TLS {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"unrecognized control plane auth policy %q\", policy)\n}\n\nfunc validatePrivateKeyProvider(pkpConf *meshconfig.PrivateKeyProvider) error {\n\tvar errs error\n\tif pkpConf.GetProvider() == nil {\n\t\terrs = multierror.Append(errs, errors.New(\"private key provider configuration is required\"))\n\t}\n\n\tswitch pkpConf.GetProvider().(type) {\n\tcase *meshconfig.PrivateKeyProvider_Cryptomb:\n\t\tcryptomb := pkpConf.GetCryptomb()\n\t\tif cryptomb == nil {\n\t\t\terrs = multierror.Append(errs, errors.New(\"cryptomb configuration is required\"))\n\t\t} else {\n\t\t\tpollDelay := cryptomb.GetPollDelay()\n\t\t\tif pollDelay == nil {\n\t\t\t\terrs = multierror.Append(errs, errors.New(\"pollDelay is required\"))\n\t\t\t} else if pollDelay.GetSeconds() == 0 && pollDelay.GetNanos() == 0 {\n\t\t\t\terrs = multierror.Append(errs, errors.New(\"pollDelay must be non zero\"))\n\t\t\t}\n\t\t}\n\tcase *meshconfig.PrivateKeyProvider_Qat:\n\t\tqatConf := pkpConf.GetQat()\n\t\tif qatConf == nil {","sourceCodeStart":453,"sourceCodeEnd":489,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pkg/config/validation/agent/validation.go#L453-L489","documentation":"Thrown by validatePrivateKeyProvider (reached from ValidateMeshConfigProxyConfig, which prefixes it with 'invalid private key provider configuration:') when a PrivateKeyProvider message is present but its oneof provider field is nil. The PrivateKeyProvider proto requires exactly one concrete provider (cryptomb or qat); an empty message means the hardware private-key provider for the proxy cannot be constructed.","triggerScenarios":"meshConfig.defaultConfig.privateKeyProvider is set to an empty object — e.g. `privateKeyProvider: {}` in mesh.yaml, or a Go struct &meshconfig.PrivateKeyProvider{} with no provider case — and ValidateMeshConfig/ValidateMeshConfigProxyConfig runs on it.","commonSituations":"YAML that declares the key but leaves it empty (intent to 'enable it later'); Helm overlays merging to an empty object; protobuf unmarshalling of a partial JSON/YAML config where the oneof was never populated.","solutions":["Set the provider oneof: add either `cryptomb: {pollDelay: ...}` or `qat: {pollDelay: ...}` under privateKeyProvider.","If you do not need a hardware private key provider, delete the privateKeyProvider stanza entirely — validation only runs when the field is non-nil.","Check YAML indentation: a mis-indented cryptomb/qat block parses as nothing, leaving the parent message empty.","Re-run istioctl validate to confirm the prefixed error disappears."],"exampleFix":"# before\ndefaultConfig:\n  privateKeyProvider: {}\n\n# after\ndefaultConfig:\n  privateKeyProvider:\n    cryptomb:\n      pollDelay: 5s","handlingStrategy":"validation","validationCode":"func checkPrivateKeyProvider(pc *meshconfig.ProxyConfig) error {\n\tpkp := pc.GetPrivateKeyProvider()\n\tif pkp == nil {\n\t\treturn nil // field optional\n\t}\n\tif pkp.GetProvider() == nil {\n\t\treturn fmt.Errorf(\"privateKeyProvider present but no cryptomb/qat case set\")\n\t}\n\treturn nil\n}","typeGuard":"func hasPrivateKeyProviderCase(pkp *meshconfig.PrivateKeyProvider) bool {\n\tswitch pkp.GetProvider().(type) {\n\tcase *meshconfig.PrivateKeyProvider_Cryptomb, *meshconfig.PrivateKeyProvider_Qat:\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":null,"preventionTips":["Write privateKeyProvider as a single complete block (provider + pollDelay) or not at all.","Validate mesh.yaml with istioctl before applying; this family of errors is fully deterministic.","Add a JSON-schema or cue check in CI requiring one of cryptomb/qat when the key is present."],"tags":["istio","mesh-config","private-key-provider","protobuf","validation","go"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}