{"record":{"id":"d3f55b7704ad63d7","repo":"istio/istio","slug":"registration-of-workloadentry-service-account-mism","errorCode":null,"errorMessage":"registration of WorkloadEntry service account mismatch: %q vs %q","messagePattern":"registration of WorkloadEntry service account mismatch: %q vs %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/pkg/autoregistration/controller.go","lineNumber":285,"sourceCode":"\t}\n\treturn err\n}\n\n// ensureProxyCanControlEntry ensures the connected proxy's identity matches that of the WorkloadEntry it is associating with.\nfunc ensureProxyCanControlEntry(proxy *model.Proxy, wle *config.Config) error {\n\tif !features.ValidateWorkloadEntryIdentity {\n\t\t// Validation disabled, skip\n\t\treturn nil\n\t}\n\tif proxy.VerifiedIdentity == nil {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry requires a verified identity\")\n\t}\n\tif proxy.VerifiedIdentity.Namespace != wle.Namespace {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry namespace mismatch: %q vs %q\", proxy.VerifiedIdentity.Namespace, wle.Namespace)\n\t}\n\tspec := wle.Spec.(*v1alpha3.WorkloadEntry)\n\tif spec.ServiceAccount != \"\" && proxy.VerifiedIdentity.ServiceAccount != spec.ServiceAccount {\n\t\treturn fmt.Errorf(\"registration of WorkloadEntry service account mismatch: %q vs %q\", proxy.VerifiedIdentity.ServiceAccount, spec.ServiceAccount)\n\t}\n\treturn nil\n}\n\n// onWorkloadConnect creates/updates WorkloadEntry of the connecting workload.\n//\n// If workload is using auto-registration, WorkloadEntry will be created automatically.\n//\n// If workload is not using auto-registration, WorkloadEntry must already exist.\nfunc (c *Controller) onWorkloadConnect(entryName string, proxy *model.Proxy, conTime time.Time, autoCreate bool) error {\n\tif autoCreate {\n\t\treturn c.registerWorkload(entryName, proxy, conTime)\n\t}\n\treturn c.becomeControllerOf(entryName, proxy, conTime)\n}\n\n// becomeControllerOf updates an existing WorkloadEntry of a workload that is not using\n// auto-registration.","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/pkg/autoregistration/controller.go#L267-L303","documentation":"The last ensureProxyCanControlEntry check: if the WorkloadEntry spec sets serviceAccount (non-empty), it must equal the verified identity's service account from the client cert. This binds the resource to one SPIFFE identity, preventing a workload holding a valid cert in the right namespace from hijacking a different service account's WorkloadEntry.","triggerScenarios":"WorkloadEntry spec.serviceAccount = \"frontend\" but the connecting proxy's cert SAN says sa/backend (same namespace, different SA) — the %q vs %q mismatch fires. Empty spec.serviceAccount intentionally skips the check.","commonSituations":"Copying a WorkloadEntry template and forgetting to update serviceAccount; rotating the VM's serviceaccount without updating the entry (or vice versa); onboarding scripts that generate the entry from one config source and the certs from another.","solutions":["Compare the two quoted service accounts: set WorkloadEntry spec.serviceAccount to the SA in the workload's certificate, or re-issue the workload's identity for the entry's SA","Leave spec.serviceAccount empty if you do not want SA binding (check still enforces namespace)","Automate: generate the WorkloadEntry from the same serviceaccount used to mint the workload's cert"],"exampleFix":"# before\nWorkloadEntry spec:\n  serviceAccount: frontend      # cert SAN: .../ns/web/sa/backend -> mismatch\n# after\nWorkloadEntry spec:\n  serviceAccount: backend       # matches the connecting workload's identity","handlingStrategy":"validation","validationCode":"if spec := entry.Spec.(*v1alpha3.WorkloadEntry); spec.ServiceAccount != \"\" && spec.ServiceAccount != certServiceAccount {\n    return fmt.Errorf(\"WorkloadEntry SA %q != workload cert SA %q\", spec.ServiceAccount, certServiceAccount)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template WorkloadEntries with spec.serviceAccount taken from the identity pipeline, not a hardcoded value","When rotating a workload's serviceaccount, update its WorkloadEntry in the same change"],"tags":["istio","security","identity","service-account","workloadentry","validation"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}