dapr/dapr · error

jwks validator not ready

Error message

jwks validator not ready

What it means

Error "jwks validator not ready" thrown in dapr/dapr.

Source

Thrown at pkg/sentry/server/validator/jwks/jwks.go:107

		j.htarget.Ready()
	}()

	// Start the cache. Note this is a blocking call
	err := j.cache.Start(ctx)
	if err != nil {
		return err
	}

	return nil
}

func (j *jwks) Validate(ctx context.Context, req *sentryv1pb.SignCertificateRequest) (validator.ValidateResult, error) {
	if req.GetToken() == "" {
		return validator.ValidateResult{}, errors.New("the request does not contain a token")
	}

	if err := j.cache.WaitForCacheReady(ctx); err != nil {
		return validator.ValidateResult{}, errors.New("jwks validator not ready")
	}

	// Validate the internal request
	// This also returns the trust domain.
	td, err := internal.Validate(ctx, req)
	if err != nil {
		return validator.ValidateResult{}, err
	}

	// Construct the expected value for the subject, which is the SPIFFE ID of the requestor
	sub, err := spiffeid.FromSegments(td, "ns", req.GetNamespace(), req.GetId())
	if err != nil {
		return validator.ValidateResult{}, fmt.Errorf("failed to construct SPIFFE ID for requestor: %w", err)
	}

	// Validate the authorization token
	_, err = jwt.Parse([]byte(req.GetToken()),
		jwt.WithKeySet(j.cache.KeySet(), jws.WithInferAlgorithmFromKey(true)),

View on GitHub (pinned to 74ad417027)

When it happens

Trigger: Thrown at pkg/sentry/server/validator/jwks/jwks.go:107 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/e369a82f45688bc5. Report an issue: GitHub.