istio/istio · error

failed to create credential fetcher: %v

Error message

failed to create credential fetcher: %v

What it means

Error "failed to create credential fetcher: %v" thrown in istio/istio.

Source

Thrown at pilot/cmd/pilot-agent/options/security.go:102

	case jwt.PolicyFirstParty:
		log.Warnf("Using deprecated JWT policy 'first-party-jwt'; treating as 'third-party-jwt'")
		jwtPath = constants.ThirdPartyJwtPath
	default:
		log.Info("Using existing certs")
	}

	o := secOpt

	// If not set explicitly, default to the discovery address.
	if o.CAEndpoint == "" {
		o.CAEndpoint = proxyConfig.DiscoveryAddress
		o.CAEndpointSAN = istiodSAN.Get()
	}

	o.CredIdentityProvider = credIdentityProvider
	credFetcher, err := credentialfetcher.NewCredFetcher(credFetcherTypeEnv, o.TrustDomain, jwtPath, o.CredIdentityProvider)
	if err != nil {
		return nil, fmt.Errorf("failed to create credential fetcher: %v", err)
	}
	log.Infof("using credential fetcher of %s type in %s trust domain", credFetcherTypeEnv, o.TrustDomain)
	o.CredFetcher = credFetcher

	if o.CAProviderName == security.GkeWorkloadCertificateProvider {
		if !security.CheckWorkloadCertificate(security.GkeWorkloadCertChainFilePath,
			security.GkeWorkloadKeyFilePath, security.GkeWorkloadRootCertFilePath) {
			return nil, fmt.Errorf("GKE workload certificate files (%v, %v, %v) not present",
				security.GkeWorkloadCertChainFilePath, security.GkeWorkloadKeyFilePath, security.GkeWorkloadRootCertFilePath)
		}
		if o.ProvCert != "" {
			return nil, fmt.Errorf(
				"invalid options: PROV_CERT and FILE_MOUNTED_CERTS of GKE workload cert are mutually exclusive")
		}
		o.FileMountedCerts = true
		o.CertChainFilePath = security.GkeWorkloadCertChainFilePath
		o.KeyFilePath = security.GkeWorkloadKeyFilePath
		o.RootCertFilePath = security.GkeWorkloadRootCertFilePath

View on GitHub (pinned to 8dc789c5cf)

When it happens

Trigger: Thrown at pilot/cmd/pilot-agent/options/security.go:102 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/181101e00e666c1e. Report an issue: GitHub.