istio/istio · error

JWT authenticator is nil

Error message

JWT authenticator is nil

What it means

Defensive guard in server startup: initOIDC parsed the JWT rule and constructed an authenticator without error, yet NewJwtAuthenticator returned a nil value. This should never happen in current code (the constructor returns a non-nil authenticator or an error), so hitting it indicates an inconsistent build or a future refactor bug, not a user misconfiguration.

Source

Thrown at pilot/pkg/bootstrap/server.go:399

	// This should be called only after controllers are initialized.
	s.initRegistryEventHandlers()

	s.initDiscoveryService()

	// Notice that the order of authenticators matters, since at runtime
	// authenticators are activated sequentially and the first successful attempt
	// is used as the authentication result.
	authenticators := []security.Authenticator{
		&authenticate.ClientCertAuthenticator{},
	}
	if args.JwtRule != "" {
		jwtAuthn, err := initOIDC(args, s.environment.Watcher)
		if err != nil {
			return nil, fmt.Errorf("error initializing OIDC: %v", err)
		}
		if jwtAuthn == nil {
			return nil, fmt.Errorf("JWT authenticator is nil")
		}
		authenticators = append(authenticators, jwtAuthn)
	}
	// The k8s JWT authenticator requires the multicluster registry to be initialized,
	// so we build it later.
	if s.kubeClient != nil {
		authenticators = append(authenticators,
			kubeauth.NewKubeJWTAuthenticator(
				s.environment.Watcher,
				s.kubeClient.Kube(),
				s.clusterID,
				args.RegistryOptions.KubeOptions.ClusterAliases,
				s.multiclusterController))
	}
	if len(features.TrustedGatewayCIDR) > 0 {
		authenticators = append(authenticators, &authenticate.XfccAuthenticator{})
	}
	if features.XDSAuth {

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Treat it as a code defect: check your Istio version / any patches to security/pkg/authentication/*.go.
2. Rebuild/upgrade to an unmodified release image and restart istiod.
3. Report upstream if reproducible with stock images.

// After calling initOIDC, guard against nil before use.
jwtAuthn, err := initOIDC(args, watcher)
if err != nil { return err }
if jwtAuthn == nil || jwtAuthn.Authenticate == nil {
    return errors.New("JWT authenticator is nil")
}

When it happens

Trigger: A modified or older istiod build where authenticate.NewJwtAuthenticator can return (nil, nil); no runtime configuration path produces it.

Common situations: Custom forks of Istio that change NewJwtAuthenticator's contract; virtually unseen in upstream releases.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• pod add cannot be retried
• netns not provided, but is needed as pod is not in cache
• invalid JWT parts: %s
• failed to decode jwt: %v
• failed to unmarshal jwt: %v

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/1d9e567455c64133. Report an issue: GitHub.