Envoy "unable to read file" / invalid path in CI

By Kaveh Alemi·Latchkey

Envoy could not read a file it was told to load: the bootstrap config path, or a TLS certificate or secret path referenced inside it. The path is wrong or the file is not mounted where Envoy expects.

What this error means

Envoy exits at startup with "unable to read file" naming the path, or "Invalid path" for the config argument passed to -c.

[critical] error initializing configuration '/etc/envoy/envoy.yaml':
unable to read file: /etc/envoy/certs/server.crt

Common causes

The config or cert path does not exist

The -c path or a filename inside the config points at a file that was not copied or mounted into the container.

A relative path resolved against the wrong directory

A relative filename resolves against Envoy's working directory, not where the file actually sits.

How to fix it

Point Envoy at the real file paths

1. Confirm the bootstrap and referenced files exist at the absolute paths in the config.
2. Mount or copy the certs and secrets to those paths in the runner or container.
3. Re-run; Envoy should load past the read step.

envoy -c /etc/envoy/envoy.yaml --service-cluster ci

Validate config without serving

Use mode validate so CI checks file paths and config without binding ports.

envoy --mode validate -c /etc/envoy/envoy.yaml

How to prevent it

• Use absolute paths for the bootstrap and referenced files.
• Mount certs and secrets to the exact paths the config names.
• Run --mode validate in CI before deploying.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation