Error: UNAUTHENTICATED - No Trust Anchors Stored for cert_type=LDP

Issue

The Hybrid Deployment Agent fails to maintain a connection and reports the following error:

UNAUTHENTICATED: No trust anchors stored for cert_type:LDP

As a result, the agent can't connect to the orchestrator and remains in a DISCONNECTED or Offline state. Connection jobs are not scheduled or executed.

Environment

• Deployment model: Hybrid Deployment
• Container platform: Kubernetes

Resolution

To resolve this issue:

1. Delete the existing Hybrid Deployment Agent secret:

   kubectl delete secret <agent-secret> -n <namespace>
   

2. In Fivetran, regenerate the Hybrid Deployment Agent token. For more information, see Regenerate agent token.
3. Verify that the new token matches the token used by the Helm deployment. Use one of the following methods:
   • Pass the token with --set in the helm upgrade command.
   • Define the token in a values.yaml file.
4. Redeploy or restart the Hybrid Deployment Agent.

If the issue persists, verify that Kubernetes autoscaling tools, such as Karpenter, are not rescheduling the Hybrid Deployment Agent pod.

Cause

This issue occurs when a previous agent deployment exists in the same Kubernetes namespace. Running helm uninstall removes the deployment but doesn't remove the associated Kubernetes secret. A new deployment may reuse the existing secret containing the previous agent token. This mismatch prevents the agent from authenticating with the orchestrator.