{"record":{"id":"8790ab81e2529474","repo":"cilium/cilium","slug":"failed-waiting-for-tls-certificates-to-become-avai","errorCode":null,"errorMessage":"failed waiting for TLS certificates to become available: %w","messagePattern":"failed waiting for TLS certificates to become available: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubble/cell/hubbleintegration.go","lineNumber":341,"sourceCode":"\t\t\t\tlogfields.Address, sockPath,\n\t\t\t)\n\t\t}\n\t\toptions := []serveroption.Option{\n\t\t\tserveroption.WithTCPListener(address),\n\t\t\tserveroption.WithHealthService(),\n\t\t\tserveroption.WithPeerService(h.peerService),\n\t\t\tserveroption.WithObserverService(hubbleObserver),\n\t\t\tserveroption.WithGRPCUnaryInterceptor(serverVersionUnaryInterceptor()),\n\t\t\tserveroption.WithGRPCStreamInterceptor(serverVersionStreamInterceptor()),\n\t\t}\n\n\t\t// Hubble TLS/mTLS setup.\n\t\tif !tlsEnabled {\n\t\t\toptions = append(options, serveroption.WithInsecure())\n\t\t} else {\n\t\t\ttlsConfig, err := h.tlsConfigPromise.Await(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed waiting for TLS certificates to become available: %w\", err)\n\t\t\t}\n\t\t\toptions = append(options, serveroption.WithServerTLS(tlsConfig))\n\t\t}\n\n\t\tsrv, err := server.NewServer(h.log, options...)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to initialize hubble server: %w\", err)\n\t\t}\n\n\t\th.log.Info(\n\t\t\t\"Starting Hubble server\",\n\t\t\tlogfields.Address, address,\n\t\t\tlogfields.TLS, tlsEnabled,\n\t\t)\n\t\tgo func() {\n\t\t\tif err := srv.Serve(); err != nil {\n\t\t\t\th.log.Error(\n\t\t\t\t\t\"Error while serving from Hubble server\",","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/hubble/cell/hubbleintegration.go#L323-L359","documentation":"When Hubble TLS/mTLS is enabled, launch awaits a TLS configuration promise (tlsConfigPromise.Await(ctx)) that resolves once the certificates are issued/available. If the promise context is cancelled or errors out before certificates become available, launch fails with this wrapped error.","triggerScenarios":"TLS is enabled for the Hubble server; h.tlsConfigPromise.Await(ctx) returns error because the certificate provider (e.g. certmanager/CA cell) did not deliver certs before ctx deadline, or the promise was explicitly failed.","commonSituations":"Certificate issuance failing (CertManager/CSI driver not ready), Hubble TLS enabled in config but the TLS cell disabled or misconfigured, agent startup timeout too short while the CA is slow.","solutions":["Check the wrapped error: context deadline exceeded means certs never arrived within the wait window; investigate the certificate provider logs.","Verify the Hubble TLS certificate secret/config is correctly provisioned (CA, cert, key) and the issuing component is healthy.","Confirm TLS configuration flags are consistent (both Hubble TLS enabled and the cert requirements satisfied) or disable Hubble TLS if not needed."],"exampleFix":"// before\nhubble:\n  tls:\n    enabled: true\n    # certs never provisioned\n// after\nhubble:\n  tls:\n    enabled: true\n    certsMethod: certmanager\n    auto:\n      enabled: true\n      certValidityDuration: 24h","handlingStrategy":"retry","validationCode":"if tlsEnabled {\n    select {\n    case <-certReadyCh:\n    case <-ctx.Done():\n        return errors.New(\"TLS certificates not available before deadline\")\n    }\n}","typeGuard":null,"tryCatchPattern":"tlsConfig, err := h.tlsConfigPromise.Await(ctx)\nif err != nil {\n    return fmt.Errorf(\"failed waiting for TLS certificates to become available: %w\", err)\n}","preventionTips":["Provision Hubble TLS certificates (certmanager/CSI) before enabling Hubble TLS.","Give the startup context a generous deadline for certificate issuance.","Monitor cert-provider health; disable Hubble TLS if certs are not managed."],"tags":["hubble","tls","certificates","startup","cilium"],"backgroundTag":"tls-certificate-unavailable","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}