{"record":{"id":"faa843dd9d8c82c5","repo":"grpc/grpc-go","slug":"failed-to-build-credentials-bundle-from-bootstrap","errorCode":null,"errorMessage":"failed to build credentials bundle from bootstrap for %q: %v","messagePattern":"failed to build credentials bundle from bootstrap for %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/xds/bootstrap/bootstrap.go","lineNumber":368,"sourceCode":"\tserver := serverConfigJSON{}\n\tif err := json.Unmarshal(data, &server); err != nil {\n\t\treturn fmt.Errorf(\"xds: failed to JSON unmarshal server configuration during bootstrap: %v, config:\\n%s\", err, string(data))\n\t}\n\n\tsc.serverURI = server.ServerURI\n\tsc.channelCreds = server.ChannelCreds\n\tsc.callCredsConfigs = server.CallCredsConfigs\n\tsc.serverFeatures = server.ServerFeatures\n\n\tfor _, cc := range server.ChannelCreds {\n\t\t// We stop at the first credential type that we support.\n\t\tc := bootstrap.GetChannelCredentials(cc.Type)\n\t\tif c == nil {\n\t\t\tcontinue\n\t\t}\n\t\tbundle, cancel, err := c.Build(cc.Config)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to build credentials bundle from bootstrap for %q: %v\", cc.Type, err)\n\t\t}\n\t\tsc.selectedChannelCreds = cc\n\t\tsc.credsDialOption = grpc.WithCredentialsBundle(bundle)\n\t\tif d, ok := bundle.(extraDialOptions); ok {\n\t\t\tsc.extraDialOptions = d.DialOptions()\n\t\t}\n\t\tsc.cleanups = append(sc.cleanups, cancel)\n\t\tbreak\n\t}\n\n\tif envconfig.XDSBootstrapCallCredsEnabled {\n\t\t// Process call credentials - unlike channel creds, we use ALL supported\n\t\t// types. Also, call credentials are optional as per gRFC A97.\n\t\tfor _, cfg := range server.CallCredsConfigs {\n\t\t\tc := bootstrap.GetCallCredentials(cfg.Type)\n\t\t\tif c == nil {\n\t\t\t\t// Skip unsupported call credential types (don't fail bootstrap).\n\t\t\t\tcontinue","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/bootstrap/bootstrap.go#L350-L386","documentation":"Returned by ServerConfig.UnmarshalJSON (internal/xds/bootstrap/bootstrap.go:367) when the first supported channel-credentials type's Build() returns an error. Bootstrap iterates `channel_creds`, looks up each type via bootstrap.GetChannelCredentials, and tries to build a bundle; the first Build error is fatal.","triggerScenarios":"A `channel_creds` entry names a known type (e.g. a TLS/cert-provider type or google_default) but its Build() fails — e.g. invalid TLS config, a cert provider plugin that cannot load its material, or google_default with no application-default credentials available.","commonSituations":"TLS creds config referencing a missing cert/key path; google_default in an environment without ADC; a cert-provider plugin misconfigured; credentials plugin not registered but type name recognized.","solutions":["Read the wrapped error (%v) — it states why Build failed (missing file, no ADC, etc.)","Fix the credentials config (correct paths, install ADC, register the cert provider)","Fall back to a creds type that builds, e.g. \"insecure\" for testing"],"exampleFix":"// before: TLS config points at non-existent files\n{\"type\":\"tls\",\"config\":{\"ca_data\":\"...\",\"cert_path\":\"/missing/cert\",\"key_path\":\"/missing/key\"}}\n// after: use a creds type that builds in this environment\n{\"type\":\"insecure\"}","handlingStrategy":"validation","validationCode":"// Pre-flight: ensure the creds material the bootstrap references exists.\nfor _, cc := range serverChannelCreds {\n    switch cc.Type {\n    case \"tls\":\n        var cfg struct {\n            CertPath string `json:\"cert_path\"`\n            KeyPath  string `json:\"key_path\"`\n        }\n        _ = json.Unmarshal(cc.Config, &cfg)\n        if cfg.CertPath != \"\" {\n            if _, err := os.Stat(cfg.CertPath); err != nil { return err }\n        }\n    case \"google_default\":\n        if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n            log.Printf(\"warning: GOOGLE_APPLICATION_CREDENTIALS unset; ADC may be unavailable\")\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := bootstrap.NewConfigFromContents(data)\nif err != nil {\n    if strings.Contains(err.Error(), \"credentials bundle\") {\n        log.Fatalf(\"bootstrap channel creds failed to build: %v\", err)\n    }\n}","preventionTips":["Mount/provision credential material before starting the process","Prefer google_default where ADC is available","Use \"insecure\" only in local dev"],"tags":["grpc","xds","bootstrap","credentials","tls","config","go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}