grpc/grpc-java · critical · XdsInitializationException

Server ${serverUri}: no supported channel credentials found

Error message

Server ${serverUri}: no supported channel credentials found

What it means

Thrown by GrpcBootstrapperImpl.getChannelCredentials when the bootstrap file's servers[].channel_creds list contains no entry whose 'type' matches a registered provider in XdsCredentialsRegistry. The gRPC xDS bootstrap requires at least one supported channel credential type per xDS server to establish the control-plane channel. If parseChannelCredentials returns null (all types unrecognized), initialization aborts with this XdsInitializationException.

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcBootstrapperImpl.java:141

      } else {
        defaultBootstrap = new GrpcBootstrapperImpl().bootstrap(defaultBootstrapOverride);
      }
    }
    return defaultBootstrap;
  }

  private static ConfiguredChannelCredentials getChannelCredentials(Map<String, ?> serverConfig,
                                                                  String serverUri)
      throws XdsInitializationException {
    List<?> rawChannelCredsList = JsonUtil.getList(serverConfig, "channel_creds");
    if (rawChannelCredsList == null || rawChannelCredsList.isEmpty()) {
      throw new XdsInitializationException(
          "Invalid bootstrap: server " + serverUri + " 'channel_creds' required");
    }
    ConfiguredChannelCredentials credentials =
        parseChannelCredentials(JsonUtil.checkObjectList(rawChannelCredsList), serverUri);
    if (credentials == null) {
      throw new XdsInitializationException(
          "Server " + serverUri + ": no supported channel credentials found");
    }
    return credentials;
  }

  @Nullable
  private static ConfiguredChannelCredentials parseChannelCredentials(List<Map<String, ?>> jsonList,
          String serverUri)
      throws XdsInitializationException {
    for (Map<String, ?> channelCreds : jsonList) {
      String type = JsonUtil.getString(channelCreds, "type");
      if (type == null) {
        throw new XdsInitializationException(
            "Invalid bootstrap: server " + serverUri + " with 'channel_creds' type unspecified");
      }
      XdsCredentialsProvider provider =  XdsCredentialsRegistry.getDefaultRegistry()
          .getProvider(type);
      if (provider != null) {

View on GitHub (pinned to 64daddc1f3)

Solutions

  1. Add a channel_creds entry with a supported 'type' (e.g. "type": "google_default" or "insecure") to the failing server in the bootstrap file.
  2. Verify the 'type' string spelling against the types registered in XdsCredentialsRegistry for your grpc-java version.
  3. If using a custom credential type, register an XdsCredentialsProvider in the registry before bootstrap parsing.
  4. Regenerate the bootstrap file with a tool/version matching your grpc-java runtime.

Example fix

// before (bootstrap.json)
"channel_creds": [{"type": "tls_pem"}]
// after
"channel_creds": [{"type": "insecure"}]
Defensive patterns

Strategy: validation

Validate before calling

// Java: pre-validate bootstrap JSON before feeding to xDS
Map<String, ?> server = JsonUtil.getObject(bootstrapJson, "servers")[0];
List<Map<String, ?>> creds = JsonUtil.checkObjectList(server.get("channel_creds"));
boolean supported = creds.stream().anyMatch(c ->
    XdsCredentialsRegistry.getDefaultRegistry().getProvider(JsonUtil.getString(c, "type")) != null);
if (!supported) throw new IllegalArgumentException("bootstrap has no supported channel_creds type");

Prevention

When it happens

Trigger: Calling Bootstrapper readBootstrap with a bootstrap JSON whose server entry lists only channel_creds entries with unsupported or typo'd 'type' values (e.g. 'tls' misspelled, or a custom type without a registered provider), so parseChannelCredentials iterates the whole list and returns null.

Common situations: Hand-edited bootstrap files with wrong credential type strings; bootstraps generated for a different gRPC implementation (e.g. Envoy-style types not registered in the Java registry); older grpc-java versions lacking a credential provider that the bootstrap assumes.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/845b1a26280478fe. Report an issue: GitHub.