{"record":{"id":"09d6e5540c359c7c","repo":"istio/istio","slug":"annotation-value-error-for-value-s-annotationfou","errorCode":null,"errorMessage":"annotation value error for value %s; annotationFound = %t: %v","messagePattern":"annotation value error for value (.+?); annotationFound = %t: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cni/pkg/plugin/sidecar_redirect.go","lineNumber":220,"sourceCode":"\t\tif err := annotationRegistry[name].validator(val); err != nil {\n\t\t\treturn true, annotationRegistry[name].defaultVal, err\n\t\t}\n\t\treturn true, val, nil\n\t}\n\t// no annotation found so use default value\n\treturn false, annotationRegistry[name].defaultVal, nil\n}\n\n// NewRedirect returns a new Redirect Object constructed from a list of ports and annotations\nfunc NewRedirect(pi *PodInfo) (*Redirect, error) {\n\tvar isFound bool\n\tvar valErr error\n\n\tredir := &Redirect{}\n\tredir.targetPort = defaultRedirectToPort\n\tisFound, redir.redirectMode, valErr = getAnnotationOrDefault(\"redirectMode\", pi.Annotations)\n\tif valErr != nil {\n\t\treturn nil, fmt.Errorf(\"annotation value error for value %s; annotationFound = %t: %v\",\n\t\t\t\"redirectMode\", isFound, valErr)\n\t}\n\n\tif pi.ProxyUID != nil && *pi.ProxyUID != 0 {\n\t\tredir.noRedirectUID = fmt.Sprintf(\"%d\", *pi.ProxyUID)\n\t} else {\n\t\tredir.noRedirectUID = defaultNoRedirectUID\n\t}\n\n\tif pi.ProxyGID != nil && *pi.ProxyGID != 0 {\n\t\tredir.noRedirectGID = fmt.Sprintf(\"%d\", *pi.ProxyGID)\n\t} else {\n\t\tredir.noRedirectGID = defaultNoRedirectGID\n\t}\n\n\tisFound, redir.includeIPCidrs, valErr = getAnnotationOrDefault(\"includeIPCidrs\", pi.Annotations)\n\tif valErr != nil {\n\t\treturn nil, fmt.Errorf(\"annotation value error for value %s; annotationFound = %t: %v\",","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/plugin/sidecar_redirect.go#L202-L238","documentation":"NewRedirect reads the redirectMode setting via getAnnotationOrDefault(\"redirectMode\", ...), backed by pod annotation sidecar.istio.io/interceptionMode with validateInterceptionMode as validator. If the annotation value is present but not exactly REDIRECT or TPROXY, construction of the Redirect object fails with this wrapper (isFound=true indicates the bad value came from the pod, not the default).","triggerScenarios":"Pod or deployment manifest sets sidecar.istio.io/interceptionMode to a lowercase/misspelled/unsupported value such as \"redirect\", \"Tproxy\", \"NONE\".","commonSituations":"Case-sensitive copy-paste errors; templates rendering an empty or optional variable incorrectly; values carried over from other mesh fields with different vocabularies.","solutions":["Set the annotation to exactly \"REDIRECT\" or \"TPROXY\", or delete it to use the REDIRECT default","Add manifest linting (kyverno/OPA) restricting the annotation to the two allowed values","Fix the templating that emits the wrong value so recreated pods pass validation"],"exampleFix":"# before\n  sidecar.istio.io/interceptionMode: \"redirect\"\n# after\n  sidecar.istio.io/interceptionMode: \"REDIRECT\"","handlingStrategy":"validation","validationCode":"func validInterceptionAnnotation(annotations map[string]string) error {\n    if v, ok := annotations[\"sidecar.istio.io/interceptionMode\"]; ok {\n        if v != \"REDIRECT\" && v != \"TPROXY\" {\n            return fmt.Errorf(\"interceptionMode must be REDIRECT or TPROXY, got %q\", v)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"Check the error text prefix \"annotation value error\" with name \"redirectMode\" to pinpoint which annotation failed; correct the pod/deployment annotation and recreate the pod.","preventionTips":["Policy rule (kyverno/OPA) constraining the annotation to the two uppercase values","Avoid free-form templating of this field; expose a typed enum in your internal modules"],"tags":["istio","cni","annotation","validation","sidecar"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}