{"record":{"id":"e53af28364d8a379","repo":"grpc/grpc-java","slug":"unsupported-configurations-in-upstreamtlscontext","errorCode":null,"errorMessage":"Unsupported configurations in UpstreamTlsContext!","messagePattern":"Unsupported configurations in UpstreamTlsContext!","errorType":"validation","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProviderFactory.java","lineNumber":79,"sourceCode":"    CommonTlsContext commonTlsContext = upstreamTlsContext.getCommonTlsContext();\n    CertificateValidationContext staticCertValidationContext\n        = CertProviderSslContextProvider.getStaticValidationContext(commonTlsContext);\n    CommonTlsContext.CertificateProviderInstance rootCertInstance\n        = CertProviderSslContextProvider.getRootCertProviderInstance(commonTlsContext);\n    CommonTlsContext.CertificateProviderInstance certInstance\n        = CertProviderSslContextProvider.getCertProviderInstance(commonTlsContext);\n    if (CommonTlsContextUtil.hasCertProviderInstance(upstreamTlsContext.getCommonTlsContext())\n        || CommonTlsContextUtil.isUsingSystemRootCerts(upstreamTlsContext.getCommonTlsContext())) {\n      return new CertProviderClientSslContextProvider(\n          node,\n          certProviders,\n          certInstance,\n          rootCertInstance,\n          staticCertValidationContext,\n          upstreamTlsContext,\n          certificateProviderStore);\n    }\n    throw new UnsupportedOperationException(\"Unsupported configurations in UpstreamTlsContext!\");\n  }\n}\n","sourceCodeStart":61,"sourceCodeEnd":82,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProviderFactory.java#L61-L82","documentation":"CertProviderClientSslContextProviderFactory.getProvider converts an xDS UpstreamTlsContext into a client SSL context provider backed by certificate providers. Only supported CommonTlsContext shapes are handled; when the upstream TLS configuration does not match any supported case, the factory throws UnsupportedOperationException with this message.","triggerScenarios":"Client channel configured with an UpstreamTlsContext whose CommonTlsContext uses material sources or validation contexts unsupported by the cert-provider path (e.g. inline/static PEM instead of certificate provider instances); getProvider exhausts its supported branches and throws.","commonSituations":"Migrating Envoy-style upstream TLS configs to grpc-java xDS; mesh control planes emitting tls_context material that grpc-java does not implement; missing cert provider plugin config in the bootstrap file.","solutions":["Use certificate provider instances (tls_certificate_provider_instance / ca_certificate_provider_instance) in the UpstreamTlsContext's CommonTlsContext, with matching entries in the bootstrap certProviders","Upgrade grpc-java to a version supporting the desired UpstreamTlsContext configuration form","Configure TLS out-of-band (custom ManagedChannel credentials) if xDS cannot express this TLS config","Pre-validate UpstreamTlsContext protos in the control plane against grpc-java's supported set"],"exampleFix":"// before: static inline certs in upstream tls context\ncommonTlsContext.tlsCertificates = [{certificate_chain: inline_bytes:..., private_key: inline_bytes:...}]\n// after: cert provider instance\ncommonTlsContext.tlsCertificateCertificateProviderInstance = {plugin_name: \"file_watcher\", instance_name: \"client_cert\"}","handlingStrategy":"validation","validationCode":"boolean supported(UpstreamTlsContext ctx) {\n  CommonTlsContext c = ctx.getCommonTlsContext();\n  return c.getTlsCertificateCertificateProviderInstanceCase()\n      == CommonTlsContext.TlsCertificateCertificateProviderInstanceCase.CERTIFICATE_PROVIDER_INSTANCE;\n}\nif (!supported(upstreamTlsContext)) throw new IllegalArgumentException(\"unsupported UpstreamTlsContext\");","typeGuard":null,"tryCatchPattern":"try {\n  provider = certProviderClientSslContextProviderFactory.getProvider(...);\n} catch (UnsupportedOperationException e) {\n  logger.error(\"xDS client TLS config unsupported; use cert-provider instances\", e);\n  throw new ConfigException(e);\n}","preventionTips":["Prefer tls_certificate_provider_instance / ca_certificate_provider_instance in UpstreamTlsContext","Ensure bootstrap certProviders matches instance names used in xDS config","Check grpc-java release notes for supported UpstreamTlsContext forms"],"tags":["xds","tls","security","grpc"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}