{"record":{"id":"bdd366fc5555ce5c","repo":"istio/istio","slug":"failed-to-decode-inlinebytes-v","errorCode":null,"errorMessage":"failed to decode inlinebytes: %v","messagePattern":"failed to decode inlinebytes: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/util/configdump/secret.go","lineNumber":55,"sourceCode":"\treturn secretDump, nil\n}\n\n// GetRootCAFromSecretConfigDump retrieves root CA from a secret config dump wrapper\nfunc (w *Wrapper) GetRootCAFromSecretConfigDump(anySec *anypb.Any) ([]byte, error) {\n\tvar secret extapi.Secret\n\tif err := anySec.UnmarshalTo(&secret); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshall ROOTCA secret: %v\", err)\n\t}\n\trCASecret := secret.GetValidationContext()\n\tif rCASecret != nil {\n\t\ttrustCA := rCASecret.GetTrustedCa()\n\t\tif trustCA != nil {\n\t\t\tinlineBytes := trustCA.GetInlineBytes()\n\t\t\tif inlineBytes != nil {\n\t\t\t\trootCA := make([]byte, base64.StdEncoding.DecodedLen(len(inlineBytes)))\n\t\t\t\t_, err := base64.StdEncoding.Decode(rootCA, inlineBytes)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to decode inlinebytes: %v\", err)\n\t\t\t\t}\n\t\t\t\treturn rootCA, err\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"cannot retrieve inlineBytes from trustCA section\")\n\t\t}\n\t\treturn nil, fmt.Errorf(\"cannot retrieve trustedCa from secret ROOTCA\")\n\t}\n\treturn nil, fmt.Errorf(\"cannot find ROOTCA from secret config dump\")\n}\n","sourceCodeStart":37,"sourceCodeEnd":65,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/util/configdump/secret.go#L37-L65","documentation":"After successfully unmarshalling a ROOTCA Secret, istioctl base64-decodes the trusted CA's inline_bytes field. This error means those bytes are not valid standard base64, so the certificate cannot be recovered. It indicates the proxy supplied a malformed inline_bytes value.","triggerScenarios":"GetRootCAFromSecretConfigDump on a secret whose validation_context.trusted_ca.inline_bytes contains characters outside the standard base64 alphabet, wrong padding, or binary written raw instead of base64.","commonSituations":"Custom or hand-crafted CA injection pipelines writing raw PEM bytes into inline_bytes; Envoy builds that emit URL-safe base64; corrupted config dumps.","solutions":["Inspect the secret dump (`istioctl proxy-config secret <pod> -o json`) and check inline_bytes is valid base64.","Fix whatever wrote the CA (e.g. istiod CA secret, custom injection) to emit standard base64 in inline_bytes.","Restart the proxy to pick up a freshly distributed trust bundle."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"rootCA, err := w.GetRootCAFromSecretConfigDump(anySec)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to decode inlinebytes\") {\n        // CA bytes are corrupt; fall back to fetching the CA from the istiod secret\n        return fetchRootCAFromIstiodSecret(client, istioNS)\n    }\n    return nil, err\n}","preventionTips":["Verify inline_bytes with a base64 decoder before deeper processing.","Only write CAs into Envoy config via standard (not URL-safe) base64.","Re-fetch fresh dumps rather than caching old ones across upgrades."],"tags":["istioctl","base64","tls","config-dump"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}