dapr/dapr · error

error parsing AllowedClockSkew duration: %w

Error message

error parsing AllowedClockSkew duration: %w

What it means

Error "error parsing AllowedClockSkew duration: %w" thrown in dapr/dapr.

Source

Thrown at pkg/sentry/config/config.go:207

	}
	return defaultConfig, nil
}

func parseConfiguration(conf Config, daprConfig *daprGlobalConfig.Configuration) (Config, error) {
	mtlsSpec := daprConfig.Spec.MTLSSpec
	if mtlsSpec != nil && mtlsSpec.WorkloadCertTTL != "" {
		d, err := time.ParseDuration(daprConfig.Spec.MTLSSpec.WorkloadCertTTL)
		if err != nil {
			return conf, fmt.Errorf("error parsing WorkloadCertTTL duration: %w", err)
		}

		conf.WorkloadCertTTL = d
	}

	if mtlsSpec != nil && mtlsSpec.AllowedClockSkew != "" {
		d, err := time.ParseDuration(mtlsSpec.AllowedClockSkew)
		if err != nil {
			return conf, fmt.Errorf("error parsing AllowedClockSkew duration: %w", err)
		}

		conf.AllowedClockSkew = d
	}

	if daprConfig.Spec.MTLSSpec != nil && len(daprConfig.Spec.MTLSSpec.ControlPlaneTrustDomain) > 0 {
		conf.TrustDomain = daprConfig.Spec.MTLSSpec.ControlPlaneTrustDomain
	}

	daprConfig.SetDefaultFeatures()
	conf.Features = daprConfig.Spec.Features

	// Get token validators
	// In Kubernetes mode, we always allow the built-in "kubernetes" validator
	// In self-hosted mode, the built-in "insecure" validator is enabled only if no other validator is configured
	conf.Validators = map[sentryv1pb.SignCertificateRequest_TokenValidator]map[string]string{}
	if IsKubernetesHosted(conf.Mode) {
		conf.DefaultValidator = sentryv1pb.SignCertificateRequest_KUBERNETES

View on GitHub (pinned to 74ad417027)

When it happens

Trigger: Thrown at pkg/sentry/config/config.go:207 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/989d5e493498ff77. Report an issue: GitHub.