{"record":{"id":"f4540f9ed4465da2","repo":"istio/istio","slug":"kubernetes-service-host-not-set-is-this-not-runni","errorCode":null,"errorMessage":"KUBERNETES_SERVICE_HOST not set. Is this not running within a pod?","messagePattern":"KUBERNETES_SERVICE_HOST not set\\. Is this not running within a pod\\?","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cni/pkg/install/kubeconfig.go","lineNumber":42,"sourceCode":"\t\"k8s.io/client-go/tools/clientcmd/api/latest\"\n\t\"sigs.k8s.io/yaml\"\n\n\t\"istio.io/istio/cni/pkg/config\"\n\t\"istio.io/istio/cni/pkg/constants\"\n\t\"istio.io/istio/pilot/pkg/model\"\n\t\"istio.io/istio/pkg/file\"\n)\n\ntype kubeconfig struct {\n\t// The full kubeconfig\n\tFull string\n\t// Kubeconfig with confidential data redacted.\n\tRedacted string\n}\n\nfunc createKubeConfig(cfg *config.InstallConfig) (kubeconfig, error) {\n\tif len(cfg.K8sServiceHost) == 0 {\n\t\treturn kubeconfig{}, fmt.Errorf(\"KUBERNETES_SERVICE_HOST not set. Is this not running within a pod?\")\n\t}\n\n\tif len(cfg.K8sServicePort) == 0 {\n\t\treturn kubeconfig{}, fmt.Errorf(\"KUBERNETES_SERVICE_PORT not set. Is this not running within a pod?\")\n\t}\n\n\tprotocol := model.GetOrDefault(cfg.K8sServiceProtocol, \"https\")\n\tcluster := &api.Cluster{\n\t\tServer: fmt.Sprintf(\"%s://%s\", protocol, net.JoinHostPort(cfg.K8sServiceHost, cfg.K8sServicePort)),\n\t}\n\n\tif cfg.SkipTLSVerify {\n\t\t// User explicitly opted into insecure.\n\t\tcluster.InsecureSkipTLSVerify = true\n\t} else {\n\t\tcaFile := model.GetOrDefault(cfg.KubeCAFile, cfg.K8sServiceAccountPath+\"/ca.crt\")\n\t\tcaContents, err := os.ReadFile(caFile)\n\t\tif err != nil {","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/install/kubeconfig.go#L24-L60","documentation":"istio-cni-node builds its kubeconfig from in-pod environment variables and found KUBERNETES_SERVICE_HOST empty. In Kubernetes, the kubelet always injects KUBERNETES_SERVICE_HOST/PORT into pods; the error text asks whether the process is running outside a pod. The value comes from cfg.K8sServiceHost, populated from the env var.","triggerScenarios":"createKubeConfig is called during install and cfg.K8sServiceHost is empty — i.e. KUBERNETES_SERVICE_HOST was not in the environment. Typical when running the install binary manually on a node, in docker without pod env, or when the env var is explicitly unset/emptied in the pod spec.","commonSituations":"Debugging the CNI binary by exec'ing it in a plain docker container; a mutated istio-cni-node pod spec that clears env vars; running install tests outside a pod without setting the variable explicitly; security scanners that strip service env vars.","solutions":["If running in Kubernetes, check the pod spec was not modified to remove the service env vars and recreate the pod.","If running outside a pod (debug/test), set KUBERNETES_SERVICE_HOST explicitly, e.g. KUBERNETES_SERVICE_HOST=<api-server-ip> ./install-cni.","Set the host via the pod spec env block with an explicit value if the default link is missing (unusual setups with disabled service links).","Verify with: kubectl -n istio-system exec istio-cni-node-xxxx -- env | grep KUBERNETES_SERVICE."],"exampleFix":"# before\n$ ./install-cni   # fails: KUBERNETES_SERVICE_HOST not set\n# after (manual run)\n$ KUBERNETES_SERVICE_HOST=10.96.0.1 KUBERNETES_SERVICE_PORT=443 ./install-cni","handlingStrategy":"validation","validationCode":"# Verify before deploying the pod spec / running manually.\nkubectl -n istio-system exec ds/istio-cni-node -- sh -c 'test -n \"$KUBERNETES_SERVICE_HOST\" && echo ok || echo missing'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run the CNI install binary only inside the daemonset pod, or export KUBERNETES_SERVICE_HOST manually.","Do not strip Kubernetes service env vars in pod specs or base images.","In tests, always set KUBERNETES_SERVICE_HOST/PORT explicitly."],"tags":["istio","cni","kubernetes","environment","install"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}