{"record":{"id":"6fd51471bde29e1e","repo":"cilium/cilium","slug":"no-certificate-manager-set-on-policy-repository","errorCode":null,"errorMessage":"No Certificate Manager set on Policy Repository","messagePattern":"No Certificate Manager set on Policy Repository","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/resolve.go","lineNumber":103,"sourceCode":"\ttraceEnabled bool\n}\n\nvar _ PolicyContext = &policyContext{}\n\n// GetNamespace() returns the namespace for the policy rule being resolved\nfunc (p *policyContext) GetNamespace() string {\n\treturn p.ns\n}\n\n// GetSelectorCache() returns the selector cache used by the Repository\nfunc (p *policyContext) GetSelectorCache() *SelectorCache {\n\treturn p.repo.GetSelectorCache()\n}\n\n// GetTLSContext() returns data for TLS Context via a CertificateManager\nfunc (p *policyContext) GetTLSContext(tls *api.TLSContext) (ca, public, private string, inlineSecrets bool, err error) {\n\tif p.repo.certManager == nil {\n\t\treturn \"\", \"\", \"\", false, fmt.Errorf(\"No Certificate Manager set on Policy Repository\")\n\t}\n\treturn p.repo.certManager.GetTLSContext(context.TODO(), tls, p.ns)\n}\n\nfunc (p *policyContext) GetEnvoyHTTPRules(l7Rules *api.L7Rules) (*cilium.HttpNetworkPolicyRules, bool) {\n\treturn p.repo.GetEnvoyHTTPRules(l7Rules, p.ns)\n}\n\n// SetPriority sets the tier and priority for the first rule being processed.\nfunc (p *policyContext) SetPriority(tier types.Tier, priority types.Priority) {\n\tp.tier = tier\n\tp.priority = priority\n}\n\n// Priority returns the tier and priority for the current rule.\nfunc (p *policyContext) Priority() (types.Tier, types.Priority) {\n\treturn p.tier, p.priority\n}","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/resolve.go#L85-L121","documentation":"policyContext.GetTLSContext resolves api.TLSContext data through the certificate manager registered on the policy repository. If no certificate manager was installed, TLS contexts (and Envoy TLS secrets) cannot be resolved, so it fails fast with this error.","triggerScenarios":"A policy containing terminatingTLS/originatingTLS (or an api.TLSContext) is imported/translated while the PolicyRepository was constructed without SetCertificateManager/with a nil certManager.","commonSituations":"Tests or custom code paths building a PolicyRepository manually and forgetting the cert manager; a refactor/upstream change moving cert-manager wiring so a code path no longer registers it; running policy resolution outside the full daemon bootstrap.","solutions":["Register a certificate manager on the repository before importing TLS-bearing policies (repo.SetCertificateManager(...))","Use the standard daemon bootstrap path which wires the cert manager automatically","If TLS sections are unused, remove terminatingTLS/originatingTLS from the policy so resolution never needs the cert manager","In tests, stub the cert manager interface rather than leaving it nil"],"exampleFix":"// before\nrepo := NewPolicyRepository(cache, nil)\n// after\nrepo := NewPolicyRepository(cache, nil)\nrepo.SetCertificateManager(certManager)","handlingStrategy":"validation","validationCode":"if repo.certManager == nil {\n  return fmt.Errorf(\"certificate manager must be set before resolving TLS contexts\")\n}","typeGuard":"func certManagerReady(repo *Repository) bool {\n  return repo != nil && repo.certManager != nil\n}","tryCatchPattern":null,"preventionTips":["Call SetCertificateManager during repository construction","Use the daemon bootstrap path for policy repos","Add an assertion in tests that TLS policies require a cert manager"],"tags":["cilium","tls","cert-manager","configuration"],"backgroundTag":"missing-dependency-not-configured","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}