{"record":{"id":"da83091ba88aa925","repo":"apache/shenyu","slug":"can-not-read-cert-and-key-from-default-secret-s-s","errorCode":null,"errorMessage":"Can not read cert and key from default secret %s/%s","messagePattern":"Can not read cert and key from default secret (.+?)/(.+?)","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-spring-boot-starter/shenyu-spring-boot-starter-k8s/src/main/java/org/apache/shenyu/springboot/starter/k8s/IngressControllerConfiguration.java","lineNumber":272,"sourceCode":"     */\n    @Bean\n    @ConditionalOnProperty(value = {\"shenyu.netty.http.web-server-factory-enabled\", \"shenyu.netty.http.sni.enabled\"}, havingValue = \"true\")\n    public TcpSslContextSpec tcpSslContextSpec(final ObjectProvider<NettyHttpProperties> properties, final ApiClient apiClient) throws ApiException {\n        NettyHttpProperties nettyHttpProperties = Optional.ofNullable(properties.getIfAvailable()).orElse(new NettyHttpProperties());\n        NettyHttpProperties.SniProperties sniProperties = nettyHttpProperties.getSni();\n        if (Objects.nonNull(sniProperties) && sniProperties.getEnabled() && \"k8s\".equals(sniProperties.getMod())) {\n            String defaultName = Optional.ofNullable(sniProperties.getDefaultK8sSecretName()).orElse(\"default-ingress-crt\");\n            String defaultNamespace = Optional.ofNullable(sniProperties.getDefaultK8sSecretNamespace()).orElse(\"default\");\n            CoreV1Api coreV1Api = new CoreV1Api(apiClient);\n            V1Secret secret = coreV1Api.readNamespacedSecret(defaultName, defaultNamespace, \"true\");\n\n            Map<String, byte[]> secretData = secret.getData();\n            if (MapUtils.isEmpty(secretData)) {\n                InputStream crtStream = new ByteArrayInputStream(secretData.get(\"tls.crt\"));\n                InputStream keyStream = new ByteArrayInputStream(secretData.get(\"tls.key\"));\n                return TcpSslContextSpec.forServer(crtStream, keyStream);\n            } else {\n                throw new ShenyuException(String.format(\"Can not read cert and key from default secret %s/%s\", defaultNamespace, defaultName));\n            }\n        }\n        return TcpSslContextSpec.forServer(new ByteArrayInputStream(new byte[]{}), new ByteArrayInputStream(new byte[]{}));\n    }\n}\n","sourceCodeStart":254,"sourceCodeEnd":278,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-spring-boot-starter/shenyu-spring-boot-starter-k8s/src/main/java/org/apache/shenyu/springboot/starter/k8s/IngressControllerConfiguration.java#L254-L278","documentation":"In k8s SNI mode the default TLS secret (tls.crt/tls.key) is read from the cluster. Note the inverted condition in the source: this message is thrown when secretData is NOT empty's opposite branch — actually when the secret's data map is empty/non-empty mis-handled, the code reads the map when it's empty or throws when data exists but the lookup fails, surfacing as failure to read cert and key from the named default secret.","triggerScenarios":"tcpSslContextSpec is asked for the default secret (defaultNamespace/defaultName) but the Kubernetes Secret cannot be read or its data map does not contain usable tls.crt/tls.key entries, so the catch-all ShenyuException fires.","commonSituations":"Secret not found due to wrong namespace/name config; service account lacking RBAC permission to read secrets; secret exists but stores keys under different names than tls.crt/tls.key.","solutions":["Verify the default secret exists: kubectl get secret <name> -n <namespace> and contains tls.crt/tls.key","Fix the shenyu.server.netty.sni.k8s default-namespace/default-secret config values","Grant the gateway service account RBAC read access to secrets","Use a valid TLS secret created via `kubectl create secret tls`"],"exampleFix":"# before\nkubectl create secret generic my-tls --from-file=cert=server.crt\n# after\nkubectl create secret tls my-tls --cert=server.crt --key=server.key","handlingStrategy":"try-catch","validationCode":"Secret secret = client.secrets().inNamespace(ns).withName(name).get();\nif (secret == null || secret.getData() == null || !secret.getData().containsKey(\"tls.crt\")\n        || !secret.getData().containsKey(\"tls.key\")) {\n    throw new IllegalStateException(\"Secret \" + ns + \"/\" + name + \" missing tls.crt/tls.key\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    factory = nettyReactiveWebServerFactory(...);\n} catch (Exception e) {\n    if (rootCauseOf(e, ShenyuException.class).map(x -> x.getMessage().contains(\"Can not read cert and key\")).orElse(false)) {\n        log.error(\"Verify default secret {}/{} exists and contains tls.crt/tls.key\", ns, name);\n    } else throw e;\n}","preventionTips":["Create TLS secrets with `kubectl create secret tls` so keys are exactly tls.crt/tls.key","Verify RBAC allows the gateway service account to read secrets in the namespace","Confirm namespace/name values match the cluster before deploy"],"tags":["kubernetes","sni","ssl","secrets"],"backgroundTag":"resource-not-found","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}