cilium/cilium · error

No Certificate Manager set on Policy Repository

Error message

No Certificate Manager set on Policy Repository

What it means

policyContext.GetTLSContext resolves api.TLSContext data through the certificate manager registered on the policy repository. If no certificate manager was installed, TLS contexts (and Envoy TLS secrets) cannot be resolved, so it fails fast with this error.

Source

Thrown at pkg/policy/resolve.go:103

	traceEnabled bool
}

var _ PolicyContext = &policyContext{}

// GetNamespace() returns the namespace for the policy rule being resolved
func (p *policyContext) GetNamespace() string {
	return p.ns
}

// GetSelectorCache() returns the selector cache used by the Repository
func (p *policyContext) GetSelectorCache() *SelectorCache {
	return p.repo.GetSelectorCache()
}

// GetTLSContext() returns data for TLS Context via a CertificateManager
func (p *policyContext) GetTLSContext(tls *api.TLSContext) (ca, public, private string, inlineSecrets bool, err error) {
	if p.repo.certManager == nil {
		return "", "", "", false, fmt.Errorf("No Certificate Manager set on Policy Repository")
	}
	return p.repo.certManager.GetTLSContext(context.TODO(), tls, p.ns)
}

func (p *policyContext) GetEnvoyHTTPRules(l7Rules *api.L7Rules) (*cilium.HttpNetworkPolicyRules, bool) {
	return p.repo.GetEnvoyHTTPRules(l7Rules, p.ns)
}

// SetPriority sets the tier and priority for the first rule being processed.
func (p *policyContext) SetPriority(tier types.Tier, priority types.Priority) {
	p.tier = tier
	p.priority = priority
}

// Priority returns the tier and priority for the current rule.
func (p *policyContext) Priority() (types.Tier, types.Priority) {
	return p.tier, p.priority
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Register a certificate manager on the repository before importing TLS-bearing policies (repo.SetCertificateManager(...))
2. Use the standard daemon bootstrap path which wires the cert manager automatically
3. If TLS sections are unused, remove terminatingTLS/originatingTLS from the policy so resolution never needs the cert manager
4. In tests, stub the cert manager interface rather than leaving it nil

Example fix

// before
repo := NewPolicyRepository(cache, nil)
// after
repo := NewPolicyRepository(cache, nil)
repo.SetCertificateManager(certManager)

if repo.certManager == nil {
  return fmt.Errorf("certificate manager must be set before resolving TLS contexts")
}

func certManagerReady(repo *Repository) bool {
  return repo != nil && repo.certManager != nil
}

When it happens

Trigger: A policy containing terminatingTLS/originatingTLS (or an api.TLSContext) is imported/translated while the PolicyRepository was constructed without SetCertificateManager/with a nil certManager.

Common situations: Tests or custom code paths building a PolicyRepository manually and forgetting the cert manager; a refactor/upstream change moving cert-manager wiring so a code path no longer registers it; running policy resolution outside the full daemon bootstrap.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• not ready
• no cilium agent pods found
• unable to detect minimum Cilium version
• certificate and private key are both required, but only one
• transport layer security required

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/6fd51471bde29e1e. Report an issue: GitHub.