istio/istio · error

qat configuration is required

Error message

qat configuration is required

What it means

Thrown by validatePrivateKeyProvider when the provider oneof selects the qat case but GetQat() returns nil — the oneof type wrapper exists while the QAT (Intel QuickAssist) sub-message is missing. Mirrors the cryptomb check: a chosen provider must carry its configuration.

Source

Thrown at pkg/config/validation/agent/validation.go:490

	}

	switch pkpConf.GetProvider().(type) {
	case *meshconfig.PrivateKeyProvider_Cryptomb:
		cryptomb := pkpConf.GetCryptomb()
		if cryptomb == nil {
			errs = multierror.Append(errs, errors.New("cryptomb configuration is required"))
		} else {
			pollDelay := cryptomb.GetPollDelay()
			if pollDelay == nil {
				errs = multierror.Append(errs, errors.New("pollDelay is required"))
			} else if pollDelay.GetSeconds() == 0 && pollDelay.GetNanos() == 0 {
				errs = multierror.Append(errs, errors.New("pollDelay must be non zero"))
			}
		}
	case *meshconfig.PrivateKeyProvider_Qat:
		qatConf := pkpConf.GetQat()
		if qatConf == nil {
			errs = multierror.Append(errs, errors.New("qat configuration is required"))
		} else {
			pollDelay := qatConf.GetPollDelay()
			if pollDelay == nil {
				errs = multierror.Append(errs, errors.New("pollDelay is required"))
			} else if pollDelay.GetSeconds() == 0 && pollDelay.GetNanos() == 0 {
				errs = multierror.Append(errs, errors.New("pollDelay must be non zero"))
			}
		}
	default:
		errs = multierror.Append(errs, errors.New("unknown private key provider"))
	}

	return errs
}

// ValidateConnectTimeout validates the envoy connection timeout
func ValidateConnectTimeout(timeout *durationpb.Duration) error {
	if err := ValidateDuration(timeout); err != nil {

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Provide the qat message with a pollDelay: `privateKeyProvider: {qat: {pollDelay: 5s}}`.
2. In JSON, omit the `qat` key rather than writing null.
3. Drop privateKeyProvider entirely if QAT hardware is not in use.

Example fix

# before (JSON)
"privateKeyProvider": {"qat": null}

# after
"privateKeyProvider": {"qat": {"pollDelay": "5s"}}

if _, ok := pkp.GetProvider().(*meshconfig.PrivateKeyProvider_Qat); ok && pkp.GetQat() == nil {
    return fmt.Errorf("qat case set but message is null; provide pollDelay or drop the key")
}

func isConcreteQat(pkp *meshconfig.PrivateKeyProvider) bool {
	q, ok := pkp.GetProvider().(*meshconfig.PrivateKeyProvider_Qat)
	return ok && q != nil && q.Qat != nil
}

When it happens

Trigger: `privateKeyProvider: {qat: null}` in JSON mesh config, or a programmatically built PrivateKeyProvider with the Qat case set but a nil Qat message, validated via ValidateMeshConfigProxyConfig.

Common situations: JSON patches setting qat to null; hand-written JSON configs declaring qat with no body; serialization tools that emit explicit nulls for empty messages.

Related errors

• private key provider configuration is required
• cryptomb configuration is required
• unknown private key provider
• pollDelay is required
• pollDelay must be non zero

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/6afd40d4477c2386. Report an issue: GitHub.