{"record":{"id":"ffe5baa13f5ec819","repo":"istio/istio","slug":"could-not-extract-tag-revision-from-webhook","errorCode":null,"errorMessage":"could not extract tag revision from webhook","messagePattern":"could not extract tag revision from webhook","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/tag/util.go","lineNumber":116,"sourceCode":"\n\tnsNames := make([]string, len(namespaces.Items))\n\tfor i, ns := range namespaces.Items {\n\t\tnsNames[i] = ns.Name\n\t}\n\treturn nsNames, nil\n}\n\n// GetWebhookTagName extracts tag name from webhook object.\nfunc GetWebhookTagName(wh admitv1.MutatingWebhookConfiguration) string {\n\treturn wh.ObjectMeta.Labels[label.IoIstioTag.Name]\n}\n\n// GetWebhookRevision extracts tag target revision from webhook object.\nfunc GetWebhookRevision(wh admitv1.MutatingWebhookConfiguration) (string, error) {\n\tif tagName, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]; ok {\n\t\treturn tagName, nil\n\t}\n\treturn \"\", fmt.Errorf(\"could not extract tag revision from webhook\")\n}\n\n// GetRevisionServices retrieves all services with the istio.io/rev label within a given namespace.\nfunc GetRevisionServices(ctx context.Context, client kubernetes.Interface, istioNS string) ([]corev1.Service, error) {\n\tservices, err := client.CoreV1().Services(istioNS).List(ctx, metav1.ListOptions{\n\t\tLabelSelector: label.IoIstioRev.Name, // Select services that have the tag label\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn services.Items, nil\n}\n\n// GetServiceTagName extracts tag name from service object.\nfunc GetServiceTagName(svc corev1.Service) string {\n\treturn svc.ObjectMeta.Labels[label.IoIstioTag.Name]\n}\n","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/tag/util.go#L98-L134","documentation":"GetWebhookRevision reads the istio.io/rev label from a MutatingWebhookConfiguration to determine which revision a tag webhook points at. The error is returned when that label is absent, so the tag machinery cannot tell what revision the webhook belongs to. It surfaces from istioctl tag subcommands (set/show/remove) that operate on webhook objects.","triggerScenarios":"Running `istioctl tag set <tag> --revision <rev>` (or tag show/remove) against a MutatingWebhookConfiguration whose labels do not include istio.io/rev — e.g. a webhook created by an old non-revisioned Istio install, a webhook whose labels were stripped/edited manually, or a custom-named webhook selected by a tag label without a rev label.","commonSituations":"Clusters migrated from pre-1.6 non-revisioned Istio where the legacy webhook (istio-sidecar-injector) has no istio.io/rev label; operators manually patching webhook labels; Helm/manifest drift removing labels.","solutions":["Inspect the webhook: kubectl get mutatingwebhookconfiguration <name> -o jsonpath='{.metadata.labels}' and confirm istio.io/rev is missing.","If the webhook belongs to a revision, re-add the label: kubectl label mutatingwebhookconfiguration <name> istio.io/rev=<revision>.","If it is a stale legacy webhook, remove it (istioctl tag remove or kubectl delete) and re-run the tag command.","Re-install the control plane with a revision so the operator/manifests recreate correctly labeled webhooks."],"exampleFix":"# before\nkubectl get mutatingwebhookconfiguration istio-sidecar-injector -o jsonpath='{.metadata.labels}'\n# {}   <- no istio.io/rev\n\n# after\nkubectl label mutatingwebhookconfiguration istio-sidecar-injector istio.io/rev=default\nistioctl tag set prod --revision default","handlingStrategy":"validation","validationCode":"// Before calling GetWebhookTagName/GetWebhookRevision:\nif _, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]; !ok {\n    return fmt.Errorf(\"webhook %q has no %s label; re-label or remove it before tag operations\", wh.Name, label.IoIstioRev.Name)\n}","typeGuard":"func HasWebhookRevision(wh admitv1.MutatingWebhookConfiguration) bool {\n    _, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]\n    return ok\n}","tryCatchPattern":null,"preventionTips":["Always install Istio with a named revision so webhooks get istio.io/rev labels from day one.","Never hand-edit webhook labels; use istioctl tag subcommands.","Periodically audit: kubectl get mutatingwebhookconfigurations -l istio.io/rev"],"tags":["istioctl","kubernetes","webhook","labels","revision"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}