{"record":{"id":"99fd8610eebf6f21","repo":"istio/istio","slug":"failed-to-fetch-mesh-config-v","errorCode":null,"errorMessage":"failed to fetch mesh config: %v","messagePattern":"failed to fetch mesh config: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/describe/describe.go","lineNumber":1442,"sourceCode":"\t\t}\n\t}\n\treturn false, fmt.Errorf(\"no container %q in pod\", containerName)\n}\n\n// describePeerAuthentication fetches all PeerAuthentication in workload and root namespace.\n// It lists the ones applied to the pod, and the current active mTLS mode.\n// When the client doesn't have access to root namespace, it will only show workload namespace Peerauthentications.\nfunc describePeerAuthentication(\n\twriter io.Writer,\n\tkubeClient kube.CLIClient,\n\tconfigClient istioclient.Interface,\n\tworkloadNamespace string,\n\tpodsLabels klabels.Set,\n\tistioNamespace string,\n) error {\n\tmeshCfg, err := getMeshConfig(kubeClient, istioNamespace)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to fetch mesh config: %v\", err)\n\t}\n\n\tworkloadPAList, err := configClient.SecurityV1().PeerAuthentications(workloadNamespace).List(context.Background(), metav1.ListOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to fetch workload namespace PeerAuthentication: %v\", err)\n\t}\n\n\trootPAList, err := configClient.SecurityV1().PeerAuthentications(meshCfg.RootNamespace).List(context.Background(), metav1.ListOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to fetch root namespace PeerAuthentication: %v\", err)\n\t}\n\n\tallPAs := append(rootPAList.Items, workloadPAList.Items...)\n\n\tvar cfgs []*config.Config\n\tfor _, pa := range allPAs {\n\t\tcfg := crdclient.TranslateObject(pa, config.GroupVersionKind(pa.GroupVersionKind()), \"\")\n\t\tcfgs = append(cfgs, &cfg)","sourceCodeStart":1424,"sourceCodeEnd":1460,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/describe/describe.go#L1424-L1460","documentation":"describePeerAuthentication() first loads the mesh config (mainly to learn meshCfg.RootNamespace) before listing PeerAuthentications. This error wraps any failure from getMeshConfig(): the istio configmap could not be read, lacks the mesh key, or its YAML failed to parse. The underlying cause is in the wrapped error text.","triggerScenarios":"ConfigMap istio (or istio-<revision>) missing from the Istio namespace; --revision tag not matching the installed configmap name; kubeconfig lacking get configmaps permission; malformed mesh YAML in the configmap.","commonSituations":"istioctl installed separately from a revisioned Istio install so the user forgets --revision; custom Istio namespace not passed via --istioNamespace; hand-edited mesh configmaps.","solutions":["Reproduce directly: kubectl get configmap -n <istio-ns> to see whether istio or istio-<rev> exists","Pass the matching --revision <tag> when the install is revisional","Pass --istioNamespace if Istio is not in istio-system","See errors for the wrapped cause (missing key / parse failure) and fix the configmap content"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := describePeerAuthentication(w, kubeClient, configClient, ns, labels, istioNS); err != nil {\n\tif strings.Contains(err.Error(), \"failed to fetch mesh config\") {\n\t\t// configmap problem: guide user to the concrete cause (missing/invalid istio configmap)\n\t\treturn fmt.Errorf(\"cannot read mesh config from %q - check --revision and --istioNamespace: %w\", istioNS, err)\n\t}\n\treturn err\n}","preventionTips":["Verify the istio configmap (or istio-<rev>) exists and parses before running describe-based tooling","Always pass --revision and --istioNamespace matching the actual install","Wrap describe calls in automation and translate wrapped causes into actionable user messages"],"tags":["istioctl","mesh-config","configmap","peerauthentication","kubernetes"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}