{"record":{"id":"0ae875368b16265a","repo":"istio/istio","slug":"unsupported-kind-v","errorCode":null,"errorMessage":"unsupported kind %v","messagePattern":"unsupported kind (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/config/kube/gatewaycommon/references.go","lineNumber":56,"sourceCode":"}\n\nfunc (s ReferenceSet) LocalPolicyTargetRef(ctx krt.HandlerContext, ref gatewayv1.LocalPolicyTargetReference, localNamespace string) (any, error) {\n\treturn s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)\n}\n\nfunc (s ReferenceSet) XLocalPolicyTargetRef(ctx krt.HandlerContext, ref gatewayx.LocalPolicyTargetReference, localNamespace string) (any, error) {\n\treturn s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)\n}\n\nfunc (s ReferenceSet) LocalPolicyRef(ctx krt.HandlerContext, ref gatewayv1.LocalObjectReference, localNamespace string) (any, error) {\n\treturn s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)\n}\n\nfunc (s ReferenceSet) internal(ctx krt.HandlerContext, name, group, kind, localNamespace string) (any, error) {\n\tt := NormalizeReference(&group, &kind, config.GroupVersionKind{})\n\tlookup, f := s.ErasedCollections[t]\n\tif !f {\n\t\treturn nil, fmt.Errorf(\"unsupported kind %v\", kind)\n\t}\n\tif v, ok := lookup(ctx, name, localNamespace); ok {\n\t\treturn v, nil\n\t}\n\treturn nil, fmt.Errorf(\"reference %v/%v (of kind %v) not found\", localNamespace, name, kind)\n}\n\nfunc NewReferenceSet(opts ...func(r *ReferenceSet)) *ReferenceSet {\n\tr := &ReferenceSet{ErasedCollections: make(map[config.GroupVersionKind]func(ctx krt.HandlerContext, name, namespace string) (any, bool))}\n\tfor _, opt := range opts {\n\t\topt(r)\n\t}\n\treturn r\n}\n\nfunc AddReference[T runtime.Object](c krt.Collection[T]) func(r *ReferenceSet) {\n\treturn func(r *ReferenceSet) {\n\t\tg := schematypes.MustGVKFromType[T]()","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/config/kube/gatewaycommon/references.go#L38-L74","documentation":"Thrown by ReferenceSet.internal (references.go:52-62), the shared resolver for Gateway API policy references in istiod: the reference's group/kind, after NormalizeReference, has no registered collection in the ReferenceSet. Only Service, ServiceEntry, ConfigMap, and Secret are registered (gateway/controller.go:226-231), so any other targetRef/caCertificateRef kind — HTTPRoute, Gateway, MeshService, InferencePool, etc. — yields 'unsupported kind %v'. Callers typically surface it in policy status (e.g. BackendTLSPolicy checks strings.Contains(err.Error(), \"unsupported kind\") to map it to BackendTLSPolicyReasonInvalidKind).","triggerScenarios":"Any policy reference whose kind is not Service/ServiceEntry/ConfigMap/Secret: e.g. BackendTLSPolicy validation.caCertificateRefs with kind: HTTPRoute, or a targetRef to kind: MeshService / kind: InferencePool / kind: Gateway. The map lookup at references.go:54 misses before any object fetch is attempted.","commonSituations":"Targeting experimental kinds (MeshService, InferencePool) not yet resolvable by this ReferenceSet; wrong group making NormalizeReference fail to find the schema (e.g. kind: Service with group: core instead of ''); typos in kind ('Services', 'ServiceEntries').","solutions":["Use one of the four resolvable kinds: Service, ServiceEntry, ConfigMap, Secret — with correct groups (\"\", networking.istio.io, \"\", \"\")","Fix typos and casing in kind, and use group: \"\" (not core/v1) for core kinds","Check the policy's status conditions — this error is usually reported there rather than crashing istiod"],"exampleFix":"# before\ntargetRefs:\n- group: networking.istio.io\n  kind: MeshService\n  name: reviews\n\n# after\ntargetRefs:\n- group: \"\"\n  kind: Service\n  name: reviews","handlingStrategy":"type-guard","validationCode":"resolvable := map[string]string{\"Service\": \"\", \"ServiceEntry\": \"networking.istio.io\", \"ConfigMap\": \"\", \"Secret\": \"\"}\nif g, ok := resolvable[string(ref.Kind)]; !ok || g != string(ref.Group) {\n    return fmt.Errorf(\"reference kind %s/%s cannot be resolved (supported: Service, ServiceEntry, ConfigMap, Secret)\", ref.Group, ref.Kind)\n}","typeGuard":"func isResolvableRefKind(group, kind string) bool {\n    switch kind {\n    case \"Service\", \"ConfigMap\", \"Secret\":\n        return group == \"\"\n    case \"ServiceEntry\":\n        return group == \"networking.istio.io\"\n    }\n    return false\n}","tryCatchPattern":"refo, err := references.XLocalPolicyTargetRef(ctx, t, ns)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported kind\") {\n        // permanent config error: surface on the policy status, do not retry\n        conds[accepted].error = &ConfigError{Reason: invalidKind, Message: err.Error()}\n    } else if strings.Contains(err.Error(), \"not found\") {\n        // target may appear later: leave for re-reconcile on collection updates\n    }\n}","preventionTips":["Restrict policy refs to Service, ServiceEntry, ConfigMap, Secret with correct groups in manifest linting","Use group: \"\" for core kinds — 'core' or 'v1' fails normalization","Treat 'unsupported kind' errors as permanent config errors (status condition), never retryable"],"tags":["istio","gateway-api","referenceresolution","targetref","kubernetes"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}