istio/istio · error

annotation value error for value %s; annotationFound = %t: %

Error message

annotation value error for value %s; annotationFound = %t: %v

What it means

NewRedirect reads the redirectMode setting via getAnnotationOrDefault("redirectMode", ...), backed by pod annotation sidecar.istio.io/interceptionMode with validateInterceptionMode as validator. If the annotation value is present but not exactly REDIRECT or TPROXY, construction of the Redirect object fails with this wrapper (isFound=true indicates the bad value came from the pod, not the default).

Source

Thrown at cni/pkg/plugin/sidecar_redirect.go:220

		if err := annotationRegistry[name].validator(val); err != nil {
			return true, annotationRegistry[name].defaultVal, err
		}
		return true, val, nil
	}
	// no annotation found so use default value
	return false, annotationRegistry[name].defaultVal, nil
}

// NewRedirect returns a new Redirect Object constructed from a list of ports and annotations
func NewRedirect(pi *PodInfo) (*Redirect, error) {
	var isFound bool
	var valErr error

	redir := &Redirect{}
	redir.targetPort = defaultRedirectToPort
	isFound, redir.redirectMode, valErr = getAnnotationOrDefault("redirectMode", pi.Annotations)
	if valErr != nil {
		return nil, fmt.Errorf("annotation value error for value %s; annotationFound = %t: %v",
			"redirectMode", isFound, valErr)
	}

	if pi.ProxyUID != nil && *pi.ProxyUID != 0 {
		redir.noRedirectUID = fmt.Sprintf("%d", *pi.ProxyUID)
	} else {
		redir.noRedirectUID = defaultNoRedirectUID
	}

	if pi.ProxyGID != nil && *pi.ProxyGID != 0 {
		redir.noRedirectGID = fmt.Sprintf("%d", *pi.ProxyGID)
	} else {
		redir.noRedirectGID = defaultNoRedirectGID
	}

	isFound, redir.includeIPCidrs, valErr = getAnnotationOrDefault("includeIPCidrs", pi.Annotations)
	if valErr != nil {
		return nil, fmt.Errorf("annotation value error for value %s; annotationFound = %t: %v",

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Set the annotation to exactly "REDIRECT" or "TPROXY", or delete it to use the REDIRECT default
2. Add manifest linting (kyverno/OPA) restricting the annotation to the two allowed values
3. Fix the templating that emits the wrong value so recreated pods pass validation

Example fix

# before
  sidecar.istio.io/interceptionMode: "redirect"
# after
  sidecar.istio.io/interceptionMode: "REDIRECT"

func validInterceptionAnnotation(annotations map[string]string) error {
    if v, ok := annotations["sidecar.istio.io/interceptionMode"]; ok {
        if v != "REDIRECT" && v != "TPROXY" {
            return fmt.Errorf("interceptionMode must be REDIRECT or TPROXY, got %q", v)
        }
    }
    return nil
}

Check the error text prefix "annotation value error" with name "redirectMode" to pinpoint which annotation failed; correct the pod/deployment annotation and recreate the pod.

When it happens

Trigger: Pod or deployment manifest sets sidecar.istio.io/interceptionMode to a lowercase/misspelled/unsupported value such as "redirect", "Tproxy", "NONE".

Common situations: Case-sensitive copy-paste errors; templates rendering an empty or optional variable incorrectly; values carried over from other mesh fields with different vocabularies.

Related errors

• interceptionMode invalid: %v
• failed parsing cidr '%s': %v
• failed parsing port %q: %v
• portList %q invalid: %v
• IPRanges invalid: %v

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/09d6e5540c359c7c. Report an issue: GitHub.