{"record":{"id":"c28c95deddca4a12","repo":"istio/istio","slug":"secret-v-v-not-found","errorCode":null,"errorMessage":"secret %v/%v not found","messagePattern":"secret (.+?)/(.+?) not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/credentials/kube/secrets.go","lineNumber":222,"sourceCode":"\t\t\t\tUser: user,\n\t\t\t},\n\t\t}, metav1.CreateOptions{})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif !resp.Status.Allowed {\n\t\t\treturn fmt.Errorf(\"%s/%s is not authorized to read secrets: %v\", serviceAccount, namespace, resp.Status.Reason)\n\t\t}\n\t\treturn nil\n\t}()\n\ts.insertCache(user, err)\n\treturn err\n}\n\nfunc (s *CredentialsController) GetCertInfo(name, namespace string) (certInfo *credentials.CertInfo, err error) {\n\tk8sSecret := s.secrets.Get(name, namespace)\n\tif k8sSecret == nil {\n\t\treturn nil, fmt.Errorf(\"secret %v/%v not found\", namespace, name)\n\t}\n\n\treturn ExtractCertInfo(k8sSecret)\n}\n\nfunc (s *CredentialsController) GetCaCert(name, namespace string) (certInfo *credentials.CertInfo, err error) {\n\tk8sSecret := s.secrets.Get(name, namespace)\n\tif k8sSecret == nil {\n\t\tstrippedName := strings.TrimSuffix(name, securitymodel.SdsCaSuffix)\n\t\t// Could not fetch cert, look for secret without -cacert suffix\n\t\tk8sSecret := s.secrets.Get(strippedName, namespace)\n\t\tif k8sSecret == nil {\n\t\t\treturn nil, fmt.Errorf(\"secret %v/%v not found\", namespace, strippedName)\n\t\t}\n\t\treturn ExtractRoot(k8sSecret.Data)\n\t}\n\treturn ExtractRoot(k8sSecret.Data)\n}","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/credentials/kube/secrets.go#L204-L240","documentation":"Returned by CredentialsController.GetCertInfo when the informer cache lookup s.secrets.Get(name, namespace) returns nil: no Kubernetes Secret with that name exists (or has reached the cache) in the namespace. This is the leaf-certificate lookup used for Gateway credentialName and similar SDS pushes.","triggerScenarios":"A Gateway (or other consumer) references credentialName=<secret name> and the Secret is absent from the namespace istiod searches (typically the Gateway's own namespace or the configured credential namespace). Also transient when the Secret was just created and the informer has not synced it yet.","commonSituations":"cert-manager or manual TLS secret not yet created when the Gateway is applied; secret created in the wrong namespace (e.g. default instead of istio-system/gateway ns); typo in credentialName; secret deleted and the gateway config not updated.","solutions":["Create the referenced secret in the correct namespace: kubectl create secret tls <name> -n <gateway-ns> --cert=... --key=...","Verify name and namespace spelling against the Gateway's credentialName and the gateway's own namespace","If just created, allow the informer a moment to sync; istiod will push the config once the secret appears (secret handlers re-trigger)","For cross-namespace credentials remember the lookup is namespace-scoped — put the secret in the Gateway's namespace"],"exampleFix":"# before: Gateway references a missing secret\ncredentialName: wildcard-tls\n\n# after: create it in the Gateway's namespace\nkubectl -n istio-system create secret tls wildcard-tls \\\n  --cert=./tls.crt --key=./tls.key","handlingStrategy":"validation","validationCode":"// Confirm the secret is present in the informer before pushing config.\nif s.secrets.Get(name, namespace) == nil {\n    return nil, fmt.Errorf(\"secret %v/%v not found; refusing to reference it\", namespace, name)\n}\ninfo, err := s.GetCertInfo(name, namespace)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create TLS secrets in the Gateway's namespace before applying the Gateway","Use admission/CI checks that every credentialName resolves to an existing secret","Remember lookups are namespace-scoped; place secrets where the gateway runs"],"tags":["istio","sds","secrets","tls","gateway","kubernetes"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}