quarkusio/quarkus · error · IllegalStateException

No default audiences configured via 'quarkus.spiffe-client.a

Error message

No default audiences configured via 'quarkus.spiffe-client.audiences'; either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience

What it means

SpiffeClientImpl.getWorkloadJsonWebToken() (no-arg) fetches a SPIFFE JWT-SVID for the audiences configured via quarkus.spiffe-client.audiences. If no default audiences were configured (defaultAudiences == null), it throws IllegalStateException: the SPIFFE Workload API requires at least one audience for JWT-SVID requests.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:137

                                        }
                                    })
                                    .endHandler(v -> {
                                        GrpcStatus status = grpcResponse.status();
                                        if (status != null && status != GrpcStatus.OK) {
                                            emitter.fail(mapGrpcError(status, grpcResponse.statusMessage()));
                                        } else {
                                            // this should be NO-OP if the message arrived
                                            emitter.fail(new SpiffeConnectionException(
                                                    "X.509-SVID stream ended without sending any message"));
                                        }
                                    }));
                }));
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken() {
        if (defaultAudiences == null) {
            throw new IllegalStateException(
                    "No default audiences configured via 'quarkus.spiffe-client.audiences'; "
                            + "either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience");
        }
        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {
        validateAudience(audience);
        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();
    }

    @Override
    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {
        if (audiences == null) {
            throw new IllegalArgumentException("Audiences must not be null");
        }
        if (audiences.isEmpty()) {

View on GitHub (pinned to e1c734241f)

Solutions

Configure default audiences: quarkus.spiffe-client.audiences=<audience1>,<audience2> in application.properties.
Alternatively call getWorkloadJsonWebToken(String audience) or getWorkloadJsonWebToken(Set<String> audiences) with explicit audiences at each call site.
If the audiences are genuinely dynamic, guard the no-arg call with a null/config check and fall back to the explicit overload.

Example fix

// before
Uni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken();

// after (explicit audience)
Uni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken("https://vault.example.com");
// or configure:
// quarkus.spiffe-client.audiences=https://vault.example.com

Defensive patterns

Strategy: validation

Validate before calling

// application.properties must contain:
// quarkus.spiffe-client.audiences=<at least one audience>
// or guard at the call site:
if (defaultAudiences == null) {
    return spiffeClient.getWorkloadJsonWebToken(explicitAudience);
}

Try / catch

try {
    return spiffeClient.getWorkloadJsonWebToken();
} catch (IllegalStateException e) {
    LOG.warn("No default audiences configured; falling back to explicit audience");
    return spiffeClient.getWorkloadJsonWebToken("https://default.example.com");
}

Prevention

Always set quarkus.spiffe-client.audiences when using the no-arg API
Prefer the explicit-argument overloads when audiences vary per call site
Verify config keys are not renamed/typo'd — missing keys load as null silently

When it happens

Trigger: Injecting/using SpiffeClient and calling getWorkloadJsonWebToken() while quarkus.spiffe-client.audiences is not set in configuration (or set empty such that defaultAudiences resolves to null).

Common situations: Apps that only ever call the explicit-argument overload forgetting to configure defaults; configuration keys renamed/typo'd so audiences never load; reusing a SpiffeClient bean across services where each service needs distinct audiences.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b99bf82b7fb2b2dd. Report an issue: GitHub.