dotnet/yarp · critical · InvalidOperationException

Missing required services. Did you call '.AddKubernetesRever

Error message

Missing required services. Did you call '.AddKubernetesReverseProxy()' when configuring services?

What it means

Thrown by UseKubernetesReverseProxyCertificateSelector when configuring HTTPS defaults on Kestrel if the IServerCertificateSelector service is not registered in DI. The extension method expects AddKubernetesReverseProxy() to have been called earlier during service configuration to register certificate-management services. This wires up the dynamic TLS certificate selection used by the Kubernetes controller.

Source

Thrown at src/Kubernetes.Controller/Management/KubernetesReverseProxyWebHostBuilderExtensions.cs:32

public static class KubernetesReverseProxyWebHostBuilderExtensions
{
    /// <summary>
    /// Configures Kestrel for SNI-based certificate selection using Kubernetes Ingress TLS annotations and Kubernetes Secrets.
    /// </summary>
    /// <param name="builder">The web host builder.</param>
    /// <returns>The same <see cref="IWebHostBuilder"/> for chaining.</returns>
    public static IWebHostBuilder UseKubernetesReverseProxyCertificateSelector(this IWebHostBuilder builder)
    {
        ArgumentNullException.ThrowIfNull(builder, nameof(builder));

        builder.ConfigureKestrel(kestrelOptions =>
        {
            kestrelOptions.ConfigureHttpsDefaults(httpsOptions =>
            {
                var selector = kestrelOptions.ApplicationServices.GetService<IServerCertificateSelector>();
                if (selector is null)
                {
                    throw new InvalidOperationException("Missing required services. Did you call '.AddKubernetesReverseProxy()' when configuring services?");
                }

                httpsOptions.ServerCertificateSelector = (connectionContext, domainName) =>
                {
                    return selector.GetCertificate(connectionContext, domainName);
                };
            });
        });

        return builder;
    }
}

View on GitHub (pinned to bd11867bee)

Solutions

1. Call builder.Services.AddKubernetesReverseProxy() before UseKubernetesReverseProxyCertificateSelector(builder).
2. Verify the correct namespace/using for the AddKubernetesReverseProxy extension is present so the right overload resolves.
3. Check that no conditional branch skips the AddKubernetesReverseProxy call in the service configuration path.

Example fix

// before
builder.UseKubernetesReverseProxyCertificateSelector();
// after
builder.Services.AddKubernetesReverseProxy();
builder.UseKubernetesReverseProxyCertificateSelector();

if (!builder.Services.Any(s => s.ServiceType == typeof(Yarp.ReverseProxy.Model.IServerCertificateSelector) /* or check via AddKubernetesReverseProxy marker */))
{
    builder.Services.AddKubernetesReverseProxy();
}

// n/a — DI service availability check

try { builder.UseKubernetesReverseProxyCertificateSelector(); }
catch (InvalidOperationException ex) when (ex.Message.Contains("AddKubernetesReverseProxy"))
{ builder.Services.AddKubernetesReverseProxy(); builder.UseKubernetesReverseProxyCertificateSelector(); }

When it happens

Trigger: Calling UseKubernetesReverseProxyCertificateSelector(builder) on the IWebHostBuilder without first calling AddKubernetesReverseProxy() on the IServiceCollection. The ConfigureHttpsDefaults lambda resolves IServerCertificateSelector from ApplicationServices and finds it null.

Common situations: Ordering mistake in Program.cs — calling the IWebHostBuilder extension before the services extension. Copying partial setup code from docs/sample without the AddKubernetesReverseProxy line.

Related errors

• At least one IProxyConfigProvider is required.
• ConfigureHttpClient will override the custom IForwarderHttpC
• Configuration Filter Error: Substitution for '{lookup}' in c
• One or more exceptions thrown by ResourceInformerCallback.
• rate: Wait(count={count}) exceeds limiter's burst {burst}

AI-assisted analysis of dotnet/yarp@bd11867bee (2026-08-13). Data as JSON: /api/errors/b052a51010f26f1e. Report an issue: GitHub.