{"record":{"id":"dee741461a2b1180","repo":"grpc/grpc-java","slug":"custom-validator-config-in-default-validation-cont","errorCode":null,"errorMessage":"custom_validator_config in default_validation_context is not supported","messagePattern":"custom_validator_config in default_validation_context is not supported","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsClusterResource.java","lineNumber":527,"sourceCode":"        }\n        if (certificateValidationContext.getVerifyCertificateSpkiCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_spki in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.getVerifyCertificateHashCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_hash in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasRequireSignedCertificateTimestamp()) {\n          throw new ResourceInvalidException(\n              \"require_signed_certificate_timestamp in default_validation_context is not \"\n                  + \"supported\");\n        }\n        if (certificateValidationContext.hasCrl()) {\n          throw new ResourceInvalidException(\"crl in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasCustomValidatorConfig()) {\n          throw new ResourceInvalidException(\n              \"custom_validator_config in default_validation_context is not supported\");\n        }\n      }\n    }\n  }\n\n  private static String getIdentityCertInstanceName(CommonTlsContext commonTlsContext) {\n    if (commonTlsContext.hasTlsCertificateProviderInstance()) {\n      return commonTlsContext.getTlsCertificateProviderInstance().getInstanceName();\n    }\n    // Fall back to deprecated field (field 11) for backward compatibility with Istio\n    @SuppressWarnings(\"deprecation\")\n    String instanceName = commonTlsContext.hasTlsCertificateCertificateProviderInstance()\n        ? commonTlsContext.getTlsCertificateCertificateProviderInstance().getInstanceName()\n        : null;\n    return instanceName;\n  }\n","sourceCodeStart":509,"sourceCodeEnd":545,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsClusterResource.java#L509-L545","documentation":"gRPC xDS rejects a CertificateValidationContext whose default_validation_context sets custom_validator_config. Pluggable custom certificate validators are not supported by grpc-java's xDS transport security, so any cluster resource carrying one is rejected with ResourceInvalidException.","triggerScenarios":"validateCommonTlsContext (reached via validateUpstreamTlsContext) encounters CertificateValidationContext.custom_validator_config (a typed extension config) inside default_validation_context of a cluster's upstream_tls_context.","commonSituations":"Envoy configs using custom validator extensions (e.g. Envoi-specific validators); frameworks injecting custom_validator_config into all TLS contexts; users expecting grpc-java extension parity with Envoy.","solutions":["Remove custom_validator_config from default_validation_context","Use the built-in validation: trust_ca plus match_subject_alt_names","Implement any bespoke validation at the application/transport layer instead","Confirm grpc-java xDS supported CertificateValidationContext fields before generating config"],"exampleFix":"# before\nvalidation_context:\n  default_validation_context:\n    custom_validator_config:\n      name: envoy.tls.cert_validator.custom\n# after\nvalidation_context:\n  default_validation_context: {}","handlingStrategy":"validation","validationCode":"if (ctx.getDefaultValidationContext().hasCustomValidatorConfig()) {\n  throw new IllegalArgumentException(\"custom_validator_config unsupported by grpc-java xDS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  cluster = XdsClusterResource.parse(resource);\n} catch (ResourceInvalidException e) {\n  logger.warn(\"Cluster rejected: {}\", e.getMessage());\n}","preventionTips":["Avoid Envoy typed_extension validators in grpc-java xDS configs","Use built-in trust_ca + SAN validation","Implement custom checks in application code instead"],"tags":["xds","grpc-java","tls","extension","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}