{"record":{"id":"bc1f56954b7abccc","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-contains-no-s","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent contains no SVIDs","messagePattern":"X\\.509-SVID response from SPIRE agent contains no SVIDs","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":286,"sourceCode":"        if (exp == null) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is missing the required 'exp' claim\");\n        }\n        Instant expiry = Instant.ofEpochSecond(exp);\n        if (expiry.isBefore(Instant.now())) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is already expired\");\n        }\n\n        record WorkloadJsonWebTokenImpl(String token, String subject, Set<String> audience,\n                Instant expiry) implements WorkloadJsonWebToken {\n        }\n        return new WorkloadJsonWebTokenImpl(token, sub, Set.copyOf(audience), expiry);\n    }\n\n    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)\n            throws SpiffeConnectionException {\n        List<X509SVID> svids = response.getSvidsList();\n        if (svids.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains no SVIDs\");\n        }\n        X509SVID svid = svids.get(0);\n\n        String protoSpiffeId = svid.getSpiffeId();\n        SpiffeValidator.validateSpiffeId(protoSpiffeId);\n        if (svid.getX509Svid().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty certificate chain\");\n        }\n        if (svid.getX509SvidKey().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty private key\");\n        }\n        if (svid.getBundle().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty trust bundle\");\n        }\n\n        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), \"certificate chain\");\n        if (certChain.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID certificate chain is empty\");","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L268-L304","documentation":"The Workload API X.509SVIDResponse returned by the SPIRE agent contained an empty list of SVIDs. The client requires at least one X.509-SVID to build the workload certificate document, so it throws instead of returning an empty/invalid result. This indicates the agent did not deliver any identity for this workload.","triggerScenarios":"Calling getWorkloadCertificate when the agent's X509SVIDs list is empty (response.getSvidsList().isEmpty()).","commonSituations":"Workload not registered in SPIRE (no registration entry matching its parent ID/selectors); wrong socket path to the Workload API; workload identity expired and agent purged it; SPIRE server unreachable so the agent has no entries to attest.","solutions":["Verify a SPIRE registration entry exists for this workload (spire-server entry show) with matching selectors and parent ID.","Check quarkus.spiffe.trust-domain/socket configuration and the SPIFFE_WORKLOAD_API endpoint the client connects to.","Verify attestation succeeded on the agent (spire-agent log; workload attestation selectors).","Recreate the registration entry and confirm the agent syncs it, then retry."],"exampleFix":"// before: workload without entry -> empty SVIDs\n// create a registration entry first:\n// spire-server entry create -spiffeID spiffe://example.org/ns/prod/sa/app \\\n//   -parentID spiffe://example.org/spire/agent/node -selector k8s:ns:prod\nWorkloadCertificateDocument doc = client.getWorkloadCertificate();","handlingStrategy":"try-catch","validationCode":"// verify a registration entry exists before starting the app:\n// spire-server entry show -spiffeID spiffe://example.org/ns/prod/sa/app\n// verify agent socket exists: ls -l /run/spire/agent-sockets/agent.sock","typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"contains no SVIDs\")) {\n        throw new IllegalStateException(\"Workload not registered with SPIRE; create a registration entry\", e);\n    } else throw e;\n}","preventionTips":["Create registration entries (selectors + parentID) before deploying the workload","Verify agent socket path in config points to a live agent","Check agent logs for attestation failures at startup","Add a readiness check that fetches an SVID before serving traffic"],"tags":["spiffe","spire","x509","empty-response"],"backgroundTag":"missing-svid-response","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}