What causes "should not fail to get empty TLS settings" in vectordotdev/vector?

Check for recent changes to MaybeTlsSettings::from_config affecting the None case and fix the regression.

should not fail to get empty TLS settings

Error message

should not fail to get empty TLS settings

What it means

spawn_grpc_server constructs MaybeTlsSettings::from_config(None, true) — i.e. TLS disabled — purely to satisfy the API, and expects it to succeed because there are no TLS options to validate. A panic here indicates the "empty" TLS config path itself failed, which can only happen if the TLS machinery rejects a default/empty configuration (a code-level bug or feature-gating issue).

Solutions

Check for recent changes to MaybeTlsSettings::from_config affecting the None case and fix the regression.
Rebuild with the TLS features enabled that the validation framework expects.
Surface the underlying error in the panic message to identify which default setting failed.

Example fix

// before
MaybeTlsSettings::from_config(None, true).expect("should not fail to get empty TLS settings")
// after
MaybeTlsSettings::from_config(None, true).unwrap_or_else(|e| panic!("empty TLS settings rejected: {e}"))

Defensive patterns

Strategy: try-catch

Try / catch

let tls = MaybeTlsSettings::from_config(None, true)
    .unwrap_or_else(|e| panic!("empty TLS settings rejected: {e}"));

Prevention

Keep TLS feature flags enabled when building the validation framework.
Watch for upstream changes to MaybeTlsSettings::from_config's None handling.
Include the underlying error text in any panic to speed diagnosis.

When it happens

Trigger: spawn_output_server or into_collector starts the validation gRPC server and MaybeTlsSettings::from_config(None, true) returns Err despite None being passed.

Common situations: Regression in the tls crate's handling of empty configs; building without required TLS features so the default path errors; platform-specific TLS initialization failure.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of vectordotdev/vector@bdb87aeaa4 (2026-09-16). Data as JSON: /api/errors/434d293e74dc9513. Report an issue: GitHub.

Appendix: source

Thrown at src/components/validation/runner/io.rs:165

) where
    S: Service<Request<Body>, Response = Response<BoxBody>, Error = Infallible>
        + NamedService
        + Clone
        + Send
        + 'static,
    S::Future: Send + 'static,
{
    let started = task_coordinator.track_started();
    let completed = task_coordinator.track_completed();
    let mut shutdown_handle = task_coordinator.register_for_shutdown();

    tokio::spawn(async move {
        started.mark_as_done();

        let (trigger_shutdown, shutdown_signal, _) = ShutdownSignal::new_wired();
        let mut trigger_shutdown = Some(trigger_shutdown);
        let tls_settings = MaybeTlsSettings::from_config(None, true)
            .expect("should not fail to get empty TLS settings");

        let server = run_grpc_server(
            listen_addr.as_socket_addr(),
            tls_settings,
            None,
            service,
            GrpcKeepaliveConfig::default(),
            shutdown_signal,
        );
        pin!(server);

        loop {
            select! {
                // Propagate our shutdown signal to the shutdown signal that `run_grpc_server` needs.
                _ = shutdown_handle.wait(), if trigger_shutdown.is_some() => {
                    trigger_shutdown.take().unwrap().cancel();
                },
                // TODO: Should we check the return value here to see if its an `Err`?

View on GitHub (pinned to bdb87aeaa4)