{"record":{"id":"f713cbdcf1e99dee","repo":"istio/istio","slug":"configmap-access-not-enabled-for-remote-clusters","errorCode":null,"errorMessage":"configmap access not enabled for remote clusters","messagePattern":"configmap access not enabled for remote clusters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/credentials/kube/secrets.go","lineNumber":244,"sourceCode":"}\n\nfunc (s *CredentialsController) GetCaCert(name, namespace string) (certInfo *credentials.CertInfo, err error) {\n\tk8sSecret := s.secrets.Get(name, namespace)\n\tif k8sSecret == nil {\n\t\tstrippedName := strings.TrimSuffix(name, securitymodel.SdsCaSuffix)\n\t\t// Could not fetch cert, look for secret without -cacert suffix\n\t\tk8sSecret := s.secrets.Get(strippedName, namespace)\n\t\tif k8sSecret == nil {\n\t\t\treturn nil, fmt.Errorf(\"secret %v/%v not found\", namespace, strippedName)\n\t\t}\n\t\treturn ExtractRoot(k8sSecret.Data)\n\t}\n\treturn ExtractRoot(k8sSecret.Data)\n}\n\nfunc (s *CredentialsController) GetConfigMapCaCert(name, namespace string) (certInfo *credentials.CertInfo, err error) {\n\tif !s.isConfigCluster {\n\t\treturn nil, fmt.Errorf(\"configmap access not enabled for remote clusters\")\n\t}\n\tstrippedName := strings.TrimSuffix(name, securitymodel.SdsCaSuffix)\n\tcm := s.configMaps.Get(strippedName, namespace)\n\tif cm == nil {\n\t\treturn nil, fmt.Errorf(\"configmap %v/%v not found\", namespace, strippedName)\n\t}\n\n\treturn ExtractRootFromString(cm.Data)\n}\n\nfunc (s *CredentialsController) GetDockerCredential(name, namespace string) ([]byte, error) {\n\tk8sSecret := s.secrets.Get(name, namespace)\n\tif k8sSecret == nil {\n\t\treturn nil, fmt.Errorf(\"secret %v/%v not found\", namespace, name)\n\t}\n\tif k8sSecret.Type != v1.SecretTypeDockerConfigJson {\n\t\treturn nil, fmt.Errorf(\"type of secret %v/%v is not %v\", namespace, name, v1.SecretTypeDockerConfigJson)\n\t}","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/credentials/kube/secrets.go#L226-L262","documentation":"Returned by CredentialsController.GetConfigMapCaCert when called on a controller constructed with isConfigCluster=false. NewCredentialsController sets that flag only for the config cluster (see multicluster.go: remote clusters get isConfigCluster=false), because the istio-ca-root-cert ConfigMap is only authoritative/readable there. The method refuses immediately rather than performing a doomed lookup.","triggerScenarios":"Requesting a ConfigMap-based root CA (resource name typically the istio-ca-root-cert configmap, often via a '-cacert' style SDS name) through a credentials controller bound to a remote cluster. In the AggregateController the config cluster's controller normally answers, so the raw error surfaces when the aggregate contains only remote controllers or the type is asserted directly.","commonSituations":"Multicluster meshes where the CA root lookup is routed to the proxy's remote cluster; ENABLE_REMOTE_CREDENTIALS_CONTROLLER combinations that leave only remote controllers in the aggregate; code/tests calling GetConfigMapCaCert directly on a remote-cluster controller.","solutions":["Route ConfigMap CA lookups to the config cluster's controller (the aggregate does this automatically when the config cluster is registered)","Ensure the config cluster credentials controller exists (see cluster-not-configured / no-controllers errors) so the aggregate has a valid member","For custom CAs on remote clusters, supply a Secret instead — secrets work on any cluster with the remote controller enabled"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only route ConfigMap CA requests to a config-cluster controller.\nif !isConfigCluster {\n    return nil, fmt.Errorf(\"skip configmap CA lookup on cluster %v; use config cluster\", clusterID)\n}\ninfo, err := ctrl.GetConfigMapCaCert(name, namespace)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always go through the AggregateController so the config cluster member serves ConfigMap CA requests","Keep ENABLE_REMOTE_CREDENTIALS_CONTROLLER semantics in mind: remotes serve secrets only, never the root ConfigMap","For remote-cluster custom CAs, distribute a Secret instead of relying on the ConfigMap path"],"tags":["istio","multicluster","configmap","ca-cert","credentials"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}