{"record":{"id":"91dc7cacafe11f2e","repo":"istio/istio","slug":"registration-of-workloadentry-namespace-mismatch","errorCode":null,"errorMessage":"registration of WorkloadEntry namespace mismatch: %q vs %q","messagePattern":"registration of WorkloadEntry namespace mismatch: %q vs %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/autoregistration/controller.go","lineNumber":281,"sourceCode":"\n\terr := c.onWorkloadConnect(entryName, proxy, conn.ConnectedAt(), autoCreate)\n\tif err != nil {\n\t\tlog.Error(err)\n\t}\n\treturn err\n}\n\n// ensureProxyCanControlEntry ensures the connected proxy's identity matches that of the WorkloadEntry it is associating with.\nfunc ensureProxyCanControlEntry(proxy *model.Proxy, wle *config.Config) error {\n\tif !features.ValidateWorkloadEntryIdentity {\n\t\t// Validation disabled, skip\n\t\treturn nil\n\t}\n\tif proxy.VerifiedIdentity == nil {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry requires a verified identity\")\n\t}\n\tif proxy.VerifiedIdentity.Namespace != wle.Namespace {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry namespace mismatch: %q vs %q\", proxy.VerifiedIdentity.Namespace, wle.Namespace)\n\t}\n\tspec := wle.Spec.(*v1alpha3.WorkloadEntry)\n\tif spec.ServiceAccount != \"\" && proxy.VerifiedIdentity.ServiceAccount != spec.ServiceAccount {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry service account mismatch: %q vs %q\", proxy.VerifiedIdentity.ServiceAccount, spec.ServiceAccount)\n\t}\n\treturn nil\n}\n\n// onWorkloadConnect creates/updates WorkloadEntry of the connecting workload.\n//\n// If workload is using auto-registration, WorkloadEntry will be created automatically.\n//\n// If workload is not using auto-registration, WorkloadEntry must already exist.\nfunc (c *Controller) onWorkloadConnect(entryName string, proxy *model.Proxy, conTime time.Time, autoCreate bool) error {\n\tif autoCreate {\n\t\treturn c.registerWorkload(entryName, proxy, conTime)\n\t}\n\treturn c.becomeControllerOf(entryName, proxy, conTime)","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/autoregistration/controller.go#L263-L299","documentation":"ensureProxyCanControlEntry compares the proxy's certificate-derived namespace against the WorkloadEntry's namespace and rejects on mismatch (VALIDATE_WORKLOAD_ENTRY_IDENTITY on). The verified identity comes from the client cert SAN (spiffe://cluster/ns/<ns>/sa/<sa>); a workload may only control WorkloadEntries in the namespace its certificate proves.","triggerScenarios":"Proxy connects with a client cert for namespace A (SAN ns/A) but its metadata associates it with a WorkloadEntry in namespace B — cross-namespace certificate/resource mismatch trips the %q vs %q error.","commonSituations":"VM bootstrap files (token/certs) copied from a workload in another namespace; WorkloadEntry created in the wrong namespace during onboarding; renaming/re-homing a VM without re-issuing its identity; multi-tenant clusters where namespace discipline matters.","solutions":["Read the two quoted namespaces in the error: cert says X, entry says Y — move the WorkloadEntry to the cert's namespace, or re-provision the workload's identity for the entry's namespace","Re-bootstrap the VM/workload so its certificate matches the intended namespace","Keep onboarding manifests and identity provisioning in one pipeline to avoid drift"],"exampleFix":"# before\ncert SAN: spiffe://cluster/ns/web/sa/vm-sa        # cert namespace = web\nWorkloadEntry: metadata.namespace: prod            # entry namespace = prod -> mismatch\n# after: align them\nWorkloadEntry created in namespace web (or VM re-bootstrapped with prod-namespace identity)","handlingStrategy":"validation","validationCode":"// At onboarding time: assert entry namespace matches the workload's cert namespace\nif entry.Namespace != certNamespace {\n    return fmt.Errorf(\"WorkloadEntry %s is in namespace %q but workload cert is %q\", entry.Name, entry.Namespace, certNamespace)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Derive the WorkloadEntry's namespace from the same namespace used to issue the workload cert","Never copy VM bootstrap material across namespaces","Include namespace in onboarding checklist diffs"],"tags":["istio","security","identity","namespaces","workloadentry","validation"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}