cilium/cilium · error

failed waiting for TLS certificates to become available: %w

Error message

failed waiting for TLS certificates to become available: %w

What it means

When Hubble TLS/mTLS is enabled, launch awaits a TLS configuration promise (tlsConfigPromise.Await(ctx)) that resolves once the certificates are issued/available. If the promise context is cancelled or errors out before certificates become available, launch fails with this wrapped error.

Source

Thrown at pkg/hubble/cell/hubbleintegration.go:341

				logfields.Address, sockPath,
			)
		}
		options := []serveroption.Option{
			serveroption.WithTCPListener(address),
			serveroption.WithHealthService(),
			serveroption.WithPeerService(h.peerService),
			serveroption.WithObserverService(hubbleObserver),
			serveroption.WithGRPCUnaryInterceptor(serverVersionUnaryInterceptor()),
			serveroption.WithGRPCStreamInterceptor(serverVersionStreamInterceptor()),
		}

		// Hubble TLS/mTLS setup.
		if !tlsEnabled {
			options = append(options, serveroption.WithInsecure())
		} else {
			tlsConfig, err := h.tlsConfigPromise.Await(ctx)
			if err != nil {
				return nil, fmt.Errorf("failed waiting for TLS certificates to become available: %w", err)
			}
			options = append(options, serveroption.WithServerTLS(tlsConfig))
		}

		srv, err := server.NewServer(h.log, options...)
		if err != nil {
			return nil, fmt.Errorf("failed to initialize hubble server: %w", err)
		}

		h.log.Info(
			"Starting Hubble server",
			logfields.Address, address,
			logfields.TLS, tlsEnabled,
		)
		go func() {
			if err := srv.Serve(); err != nil {
				h.log.Error(
					"Error while serving from Hubble server",

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the wrapped error: context deadline exceeded means certs never arrived within the wait window; investigate the certificate provider logs.
2. Verify the Hubble TLS certificate secret/config is correctly provisioned (CA, cert, key) and the issuing component is healthy.
3. Confirm TLS configuration flags are consistent (both Hubble TLS enabled and the cert requirements satisfied) or disable Hubble TLS if not needed.

Example fix

// before
hubble:
  tls:
    enabled: true
    # certs never provisioned
// after
hubble:
  tls:
    enabled: true
    certsMethod: certmanager
    auto:
      enabled: true
      certValidityDuration: 24h

if tlsEnabled {
    select {
    case <-certReadyCh:
    case <-ctx.Done():
        return errors.New("TLS certificates not available before deadline")
    }
}

tlsConfig, err := h.tlsConfigPromise.Await(ctx)
if err != nil {
    return fmt.Errorf("failed waiting for TLS certificates to become available: %w", err)
}

When it happens

Trigger: TLS is enabled for the Hubble server; h.tlsConfigPromise.Await(ctx) returns error because the certificate provider (e.g. certmanager/CA cell) did not deliver certs before ctx deadline, or the promise was explicitly failed.

Common situations: Certificate issuance failing (CertManager/CSI driver not ready), Hubble TLS enabled in config but the TLS cell disabled or misconfigured, agent startup timeout too short while the CA is slow.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• endpoint manager is not loaded
• trust bundle not yet available
• certificate and private key are both required, but only one
• certificate file path is required
• failed to resolve Hubble exporters: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/8790ab81e2529474. Report an issue: GitHub.