{"record":{"id":"b18e8d70dc73ee67","repo":"istio/istio","slug":"workloadgroup-s-not-found-in-namespace-s-v","errorCode":null,"errorMessage":"workloadgroup %s not found in namespace %s: %v","messagePattern":"workloadgroup (.+?) not found in namespace (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/workload/workload.go","lineNumber":239,"sourceCode":"\t\t\t}\n\t\t\treturn nil\n\t\t},\n\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\tkubeClient, err := ctx.CLIClientWithRevision(ctx.RevisionOrDefault(opts.Revision))\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\twg := &clientnetworking.WorkloadGroup{}\n\t\t\tif filename != \"\" {\n\t\t\t\tif err := readWorkloadGroup(filename, wg); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\twg, err = kubeClient.Istio().NetworkingV1().WorkloadGroups(namespace).Get(context.Background(), name, metav1.GetOptions{})\n\t\t\t\t// errors if the requested workload group does not exist in the given namespace\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"workloadgroup %s not found in namespace %s: %v\", name, namespace, err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// extract the cluster ID from the injector config (.Values.global.multiCluster.clusterName)\n\t\t\tif !validateFlagIsSetManuallyOrNot(cmd, \"clusterID\") {\n\t\t\t\t// extract the cluster ID from the injector config if it is not set by user\n\t\t\t\tclusterName, err := extractClusterIDFromInjectionConfig(kubeClient, ctx.IstioNamespace())\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to automatically determine the --clusterID: %v\", err)\n\t\t\t\t}\n\t\t\t\tif clusterName != \"\" {\n\t\t\t\t\tclusterID = clusterName\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif err = createConfig(kubeClient, wg, ctx.IstioNamespace(), clusterID, ingressIP, internalIP, externalIP, outputDir, cmd.OutOrStderr()); err != nil {\n\t\t\t\treturn err\n\t\t\t}","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/workload/workload.go#L221-L257","documentation":"RunE of `istioctl x workload entry configure` (istioctl/pkg/workload/workload.go:239): the -f path was empty so it fetched WorkloadGroups(namespace).Get(name) from the API server and the get returned an error (usually 404), wrapped as `workloadgroup %s not found in namespace %s: %v`. Note the call uses the raw namespace variable, not the kubeconfig default.","triggerScenarios":"`configure --name foo -n wrong-ns -o config` where foo lives elsewhere; WorkloadGroup never created (step `workload group create` skipped or its output not applied with kubectl); wrong cluster context; RBAC denial is also surfaced here since any Get error triggers it.","commonSituations":"Multi-step VM onboarding where `istioctl x workload group create` YAML was generated but never `kubectl apply`ed; typo in name/namespace; pointing at the wrong cluster in a multi-cluster mesh.","solutions":["Confirm the resource exists: `kubectl get workloadgroups -n <ns> <name>`","If missing, generate and apply it first: `istioctl x workload group create --name <name> -n <ns> ... | kubectl apply -f -`","Verify context/cluster: `kubectl config current-context`","Alternatively switch to the artifact path: `-f workloadgroup.yaml` to bypass the API server lookup"],"exampleFix":"# before\nistioctl x workload entry configure --name foo -n bar -o config   # not found\n# after\nistioctl x workload group create --name foo -n bar --serviceAccount sa | kubectl apply -f -\nistioctl x workload entry configure --name foo -n bar -o config","handlingStrategy":"validation","validationCode":"kubectl get workloadgroup \"$WG_NAME\" -n \"$WG_NS\" >/dev/null 2>&1 || {\n  echo \"workloadgroup missing; creating\" >&2\n  istioctl x workload group create --name \"$WG_NAME\" -n \"$WG_NS\" | kubectl apply -f -\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Chain group create | kubectl apply before entry configure in onboarding scripts","Prefer -f workloadgroup.yaml on VMs to avoid cluster lookups entirely","Assert kubectl config current-context equals the intended cluster in multi-cluster setups"],"tags":["istioctl","workload","workloadgroup","vm","kubernetes-api","not-found"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}