{"record":{"id":"5a643039b49cabcc","repo":"grpc/grpc-java","slug":"common-tls-context-with-validation-context-sds-sec","errorCode":null,"errorMessage":"common-tls-context with validation_context_sds_secret_config is not supported","messagePattern":"common-tls-context with validation_context_sds_secret_config is not supported","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsClusterResource.java","lineNumber":459,"sourceCode":"    } else {\n      throw new ResourceInvalidException(\"common-tls-context is required in upstream-tls-context\");\n    }\n    return upstreamTlsContext;\n  }\n\n  @VisibleForTesting\n  static void validateCommonTlsContext(\n      CommonTlsContext commonTlsContext, Set<String> certProviderInstances, boolean server)\n      throws ResourceInvalidException {\n    if (commonTlsContext.hasCustomHandshaker()) {\n      throw new ResourceInvalidException(\n          \"common-tls-context with custom_handshaker is not supported\");\n    }\n    if (commonTlsContext.hasTlsParams()) {\n      throw new ResourceInvalidException(\"common-tls-context with tls_params is not supported\");\n    }\n    if (commonTlsContext.hasValidationContextSdsSecretConfig()) {\n      throw new ResourceInvalidException(\n          \"common-tls-context with validation_context_sds_secret_config is not supported\");\n    }\n    String certInstanceName = getIdentityCertInstanceName(commonTlsContext);\n    if (certInstanceName == null) {\n      if (server) {\n        throw new ResourceInvalidException(\n            \"tls_certificate_provider_instance is required in downstream-tls-context\");\n      }\n      if (commonTlsContext.getTlsCertificatesCount() > 0) {\n        throw new ResourceInvalidException(\n            \"tls_certificate_provider_instance is unset\");\n      }\n      if (commonTlsContext.getTlsCertificateSdsSecretConfigsCount() > 0) {\n        throw new ResourceInvalidException(\n            \"tls_certificate_provider_instance is unset\");\n      }\n    } else if (certProviderInstances == null || !certProviderInstances.contains(certInstanceName)) {\n      throw new ResourceInvalidException(","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsClusterResource.java#L441-L477","documentation":"validation_context_sds_secret_config (a SecretDiscoveryService-based validation context) is not supported by the gRPC xDS client; only inline validation_context, combined_validation_context, or a certificate provider instance root are allowed. Presence of this field invalidates the cluster resource.","triggerScenarios":"A common_tls_context inside upstream_tls_context/downstream_tls_context sets validation_context_sds_secret_config referencing an SDS secret name. validateCommonTlsContext throws ResourceInvalidException at XdsClusterResource.java:459.","commonSituations":"Envoy deployments that distribute CA certs via SDS secrets and reuse the same resources for gRPC clients; control planes (e.g. some Istio/Envoy-generated configs) that always emit SDS-based validation contexts.","solutions":["Replace validation_context_sds_secret_config with an inline validation_context carrying trusted_ca.","Use combined_validation_context with a default_validation_context and a certificate_provider_instance for root certs.","Point the control plane at gRPC-supported config (certificate provider instances from the gRPC bootstrap) instead of SDS secrets."],"exampleFix":"// before\n\"common_tls_context\": {\n  \"validation_context_sds_secret_config\": { \"name\": \"validation-context-sds\" }\n}\n// after\n\"common_tls_context\": {\n  \"validation_context\": { \"trusted_ca\": { \"filename\": \"/etc/certs/ca.pem\" } }\n}","handlingStrategy":"validation","validationCode":"if (commonTlsContext.hasValidationContextSdsSecretConfig()) {\n  throw new IllegalArgumentException(\"use inline validation_context instead of SDS secret config\");\n}","typeGuard":null,"tryCatchPattern":"catch (ResourceInvalidException e) {\n  if (e.getMessage().contains(\"validation_context_sds_secret_config\")) {\n    // regenerate resource with inline trusted_ca\n  }\n}","preventionTips":["Prefer validation_context or combined_validation_context in all gRPC-targeted resources.","Reserve SDS secrets for Envoy-only clusters, not clusters consumed by gRPC xDS clients."],"tags":["grpc","xds","tls","sds"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}