{"record":{"id":"d656fec415d19ed6","repo":"thanos-io/thanos","slug":"tls-client-cert-field-requested-is-not-supported","errorCode":null,"errorMessage":"tls client cert field requested is not supported","messagePattern":"tls client cert field requested is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tenancy/tenancy.go","lineNumber":129,"sourceCode":"\t\tif len(cert.Subject.Organization) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organization field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.Organization[0]\n\n\tcase CertificateFieldOrganizationalUnit:\n\t\tif len(cert.Subject.OrganizationalUnit) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organizationalUnit field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.OrganizationalUnit[0]\n\n\tcase CertificateFieldCommonName:\n\t\tif cert.Subject.CommonName == \"\" {\n\t\t\treturn \"\", errors.New(\"could not get commonName field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.CommonName\n\n\tdefault:\n\t\treturn \"\", errors.New(\"tls client cert field requested is not supported\")\n\t}\n\n\treturn tenant, nil\n}\n\nfunc GetTenantFromGRPCMetadata(ctx context.Context) (string, bool) {\n\tmd, ok := metadata.FromIncomingContext(ctx)\n\tif !ok || len(md.Get(DefaultTenantHeader)) == 0 {\n\t\treturn DefaultTenant, false\n\t}\n\treturn md.Get(DefaultTenantHeader)[0], true\n}\n\nfunc EnforceQueryTenancy(tenantLabel string, tenant string, query string) (string, error) {\n\tlabelMatcher := &labels.Matcher{\n\t\tName:  tenantLabel,\n\t\tType:  labels.MatchEqual,\n\t\tValue: tenant,","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tenancy/tenancy.go#L111-L147","documentation":"Thrown by getTenantFromCertificate when the configured tenant certificate field does not match any supported case (organization, organizationalUnit, commonName). This indicates an invalid value for the tenancy configuration rather than a problem with the certificate itself.","triggerScenarios":"GetTenantFromHTTP invoked with a certTenantField value outside the CertificateField constants, e.g. an unparsed or misspelled --tenant-certificate-field flag value reaching this switch's default branch.","commonSituations":"Typo in the tenant-certificate-field flag value; a new/older Thanos version adding or renaming field constants; config generated programmatically with an unvalidated string.","solutions":["Set --tenant-certificate-field to one of the supported values: organization, organizationalUnit, or common-name","Check 'thanos <subcmd> --help' for the exact accepted values in your version","Validate the flag value at startup; rely on the flag's built-in enum parsing if available","Align config templates with the Thanos version in use after upgrades"],"exampleFix":"// before\n--tenant-certificate-field=Org\n// after\n--tenant-certificate-field=organization","handlingStrategy":"validation","validationCode":"// Validate the flag before starting the server\nallowed := map[string]bool{\"organization\": true, \"organizationalUnit\": true, \"commonName\": true}\nif !allowed[tlsCertField] {\n    log.Fatalf(\"unsupported --tenant-certificate-field %q\", tlsCertField)\n}","typeGuard":"func isSupportedCertField(f string) bool {\n    switch f {\n    case \"organization\", \"organizationalUnit\", \"commonName\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Use the built-in flag enum/choices rather than free text","Review tenancy flags after Thanos upgrades","Add config linting in deployment pipelines"],"tags":["tenancy","configuration","tls","invalid-flag"],"backgroundTag":"invalid-enum-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}