istio/istio · error

failed to decode inlinebytes: %v

Error message

failed to decode inlinebytes: %v

What it means

After successfully unmarshalling a ROOTCA Secret, istioctl base64-decodes the trusted CA's inline_bytes field. This error means those bytes are not valid standard base64, so the certificate cannot be recovered. It indicates the proxy supplied a malformed inline_bytes value.

Source

Thrown at istioctl/pkg/util/configdump/secret.go:55

	return secretDump, nil
}

// GetRootCAFromSecretConfigDump retrieves root CA from a secret config dump wrapper
func (w *Wrapper) GetRootCAFromSecretConfigDump(anySec *anypb.Any) ([]byte, error) {
	var secret extapi.Secret
	if err := anySec.UnmarshalTo(&secret); err != nil {
		return nil, fmt.Errorf("failed to unmarshall ROOTCA secret: %v", err)
	}
	rCASecret := secret.GetValidationContext()
	if rCASecret != nil {
		trustCA := rCASecret.GetTrustedCa()
		if trustCA != nil {
			inlineBytes := trustCA.GetInlineBytes()
			if inlineBytes != nil {
				rootCA := make([]byte, base64.StdEncoding.DecodedLen(len(inlineBytes)))
				_, err := base64.StdEncoding.Decode(rootCA, inlineBytes)
				if err != nil {
					return nil, fmt.Errorf("failed to decode inlinebytes: %v", err)
				}
				return rootCA, err
			}
			return nil, fmt.Errorf("cannot retrieve inlineBytes from trustCA section")
		}
		return nil, fmt.Errorf("cannot retrieve trustedCa from secret ROOTCA")
	}
	return nil, fmt.Errorf("cannot find ROOTCA from secret config dump")
}

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Inspect the secret dump (`istioctl proxy-config secret <pod> -o json`) and check inline_bytes is valid base64.
2. Fix whatever wrote the CA (e.g. istiod CA secret, custom injection) to emit standard base64 in inline_bytes.
3. Restart the proxy to pick up a freshly distributed trust bundle.

rootCA, err := w.GetRootCAFromSecretConfigDump(anySec)
if err != nil {
    if strings.Contains(err.Error(), "failed to decode inlinebytes") {
        // CA bytes are corrupt; fall back to fetching the CA from the istiod secret
        return fetchRootCAFromIstiodSecret(client, istioNS)
    }
    return nil, err
}

When it happens

Trigger: GetRootCAFromSecretConfigDump on a secret whose validation_context.trusted_ca.inline_bytes contains characters outside the standard base64 alphabet, wrong padding, or binary written raw instead of base64.

Common situations: Custom or hand-crafted CA injection pipelines writing raw PEM bytes into inline_bytes; Envoy builds that emit URL-safe base64; corrupted config dumps.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to unmarshall ROOTCA secret: %v
• cannot retrieve inlineBytes from trustCA section
• cannot retrieve trustedCa from secret ROOTCA
• cannot find ROOTCA from secret config dump
• can't parse ingress gateway sidecar config_dump: %v

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/bdd366fc5555ce5c. Report an issue: GitHub.