security configuration on the server-side does not contain…

Error message

security configuration on the server-side does not contain identity certificate provider instance name

What it means

Thrown by securityConfigFromCommonTLSContext when a server-side (listener inbound) TLS configuration was received from the control plane, but the resulting SecurityConfig has an empty IdentityInstanceName. The grpc-go xDS client requires an identity certificate provider instance name to fetch the server's own cert chain; without it, mTLS handshakes cannot present a cert. The error is returned while unmarshaling a Cluster (CDS) security config, after both the new (tls_certificate_provider_instance) and deprecated field paths failed to populate it.

Solutions

Inspect the CDS resource from the control plane and confirm the CommonTlsContext includes a tls_certificate_provider_instance or the deprecated tls_certificate_certificate_provider_instance with a non-empty instance_name.
Verify the xDS bootstrap file's certificate_providers section defines the provider instance name that the control plane is referencing.
If using Istio, confirm the DestinationRule/PeerAuthentication actually provisions an SDS identity cert and the workload's SDS socket exposes that name.
Regenerate/redeploy the bootstrap or control-plane config so the identity provider instance name is non-empty for server-side listeners.

Example fix

// before: control plane emits CommonTlsContext with no identity provider
//   tls_context: { common_tls_context: {} }
//
// after: include an identity certificate provider instance name
//   tls_context: {
//     common_tls_context: {
//       tls_certificate_provider_instance: { instance_name: "default" }
//     }
//   }

Defensive patterns

Strategy: validation

Try / catch

This error originates from xDS resource unmarshaling driven by the control plane; callers cannot pre-validate remote proto bytes. Handle it by inspecting the error returned from xdsclient resource callbacks (NewWatch / WatchCluster) and logging the resource name + version so the operator can correct the control-plane config. Do not retry unchanged; the resource will keep failing until reconfigured.

Prevention

In CI, run the control-plane's CDS resources through a policy check that requires tls_certificate_provider_instance.instance_name to be non-empty for any server-side TLS context.
Keep a documented mapping of bootstrap certificate_providers names to control-plane instance_name values.
Unit-test your control-plane emitter against grpc-go's expected schema before deploy.

When it happens

Trigger: A CDS response contains an UpstreamTlsContext/CommonTlsContext for a server (server=true path invoked during inbound listener handling, or a cluster reused server-side) where neither tls_certificate_certificate_provider_instance (deprecated) nor the new tls_context.common_tls_context.tls_certificate_provider_instance has a non-empty instance_name. The control plane sent a partial TLS config.

Common situations: Misconfigured Istio/Envoy/xDS control plane that sets a TLS context but omits the certificate provider instance. Migration from deprecated SDS fields to the new envoy.transport_sockets.tls fields where the new field's instance_name was left blank. Bootstrap file (cert_provider_instances in the xds bootstrap) referencing a provider name that does not match what the control plane emits.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of grpc/grpc-go@0c51461d27 (2026-08-11). Data as JSON: /api/errors/bf984cf18c56a371. Report an issue: GitHub.

Appendix: source

Thrown at internal/xds/xdsclient/xdsresource/unmarshal_cds.go:414

	// For now, if we can't get a valid security config from the new fields, we
	// fallback to the old deprecated fields.
	// TODO: Drop support for deprecated fields. NACK if err != nil here.
	sc, err1 := securityConfigFromCommonTLSContextUsingNewFields(common, server)
	if sc == nil || sc.Equal(&SecurityConfig{}) {
		var err error
		sc, err = securityConfigFromCommonTLSContextWithDeprecatedFields(common, server)
		if err != nil {
			// Retain the validation error from using the new fields.
			return nil, errors.Join(err1, fmt.Errorf("failed to parse config using deprecated fields: %v", err))
		}
	}
	if sc != nil {
		// sc == nil is a valid case where the control plane has not sent us any
		// security configuration. xDS creds will use fallback creds.
		if server {
			if sc.IdentityInstanceName == "" {
				return nil, errors.New("security configuration on the server-side does not contain identity certificate provider instance name")
			}
		} else {
			if !sc.UseSystemRootCerts && sc.RootInstanceName == "" {
				return nil, errors.New("security configuration on the client-side does not contain root certificate provider instance name")
			}
		}
	}
	return sc, nil
}

func securityConfigFromCommonTLSContextWithDeprecatedFields(common *v3tlspb.CommonTlsContext, server bool) (*SecurityConfig, error) {
	// The `CommonTlsContext` contains a
	// `tls_certificate_certificate_provider_instance` field of type
	// `CertificateProviderInstance`, which contains the provider instance name
	// and the certificate name to fetch identity certs.
	sc := &SecurityConfig{}
	if identity := common.GetTlsCertificateCertificateProviderInstance(); identity != nil {
		sc.IdentityInstanceName = identity.GetInstanceName()

View on GitHub (pinned to 0c51461d27)