istio/istio · error

could not extract tag revision from webhook

Error message

could not extract tag revision from webhook

What it means

GetWebhookRevision reads the istio.io/rev label from a MutatingWebhookConfiguration to determine which revision a tag webhook points at. The error is returned when that label is absent, so the tag machinery cannot tell what revision the webhook belongs to. It surfaces from istioctl tag subcommands (set/show/remove) that operate on webhook objects.

Source

Thrown at istioctl/pkg/tag/util.go:116

	nsNames := make([]string, len(namespaces.Items))
	for i, ns := range namespaces.Items {
		nsNames[i] = ns.Name
	}
	return nsNames, nil
}

// GetWebhookTagName extracts tag name from webhook object.
func GetWebhookTagName(wh admitv1.MutatingWebhookConfiguration) string {
	return wh.ObjectMeta.Labels[label.IoIstioTag.Name]
}

// GetWebhookRevision extracts tag target revision from webhook object.
func GetWebhookRevision(wh admitv1.MutatingWebhookConfiguration) (string, error) {
	if tagName, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]; ok {
		return tagName, nil
	}
	return "", fmt.Errorf("could not extract tag revision from webhook")
}

// GetRevisionServices retrieves all services with the istio.io/rev label within a given namespace.
func GetRevisionServices(ctx context.Context, client kubernetes.Interface, istioNS string) ([]corev1.Service, error) {
	services, err := client.CoreV1().Services(istioNS).List(ctx, metav1.ListOptions{
		LabelSelector: label.IoIstioRev.Name, // Select services that have the tag label
	})
	if err != nil {
		return nil, err
	}
	return services.Items, nil
}

// GetServiceTagName extracts tag name from service object.
func GetServiceTagName(svc corev1.Service) string {
	return svc.ObjectMeta.Labels[label.IoIstioTag.Name]
}

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Inspect the webhook: kubectl get mutatingwebhookconfiguration <name> -o jsonpath='{.metadata.labels}' and confirm istio.io/rev is missing.
2. If the webhook belongs to a revision, re-add the label: kubectl label mutatingwebhookconfiguration <name> istio.io/rev=<revision>.
3. If it is a stale legacy webhook, remove it (istioctl tag remove or kubectl delete) and re-run the tag command.
4. Re-install the control plane with a revision so the operator/manifests recreate correctly labeled webhooks.

Example fix

# before
kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o jsonpath='{.metadata.labels}'
# {}   <- no istio.io/rev

# after
kubectl label mutatingwebhookconfiguration istio-sidecar-injector istio.io/rev=default
istioctl tag set prod --revision default

// Before calling GetWebhookTagName/GetWebhookRevision:
if _, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]; !ok {
    return fmt.Errorf("webhook %q has no %s label; re-label or remove it before tag operations", wh.Name, label.IoIstioRev.Name)
}

func HasWebhookRevision(wh admitv1.MutatingWebhookConfiguration) bool {
    _, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]
    return ok
}

When it happens

Trigger: Running `istioctl tag set <tag> --revision <rev>` (or tag show/remove) against a MutatingWebhookConfiguration whose labels do not include istio.io/rev — e.g. a webhook created by an old non-revisioned Istio install, a webhook whose labels were stripped/edited manually, or a custom-named webhook selected by a tag label without a rev label.

Common situations: Clusters migrated from pre-1.6 non-revisioned Istio where the legacy webhook (istio-sidecar-injector) has no istio.io/rev label; operators manually patching webhook labels; Helm/manifest drift removing labels.

Related errors

• could not find valid mutatingWebhookConfiguration %q from cl
• expected a single webhook for default revision
• could not read configmap %q from namespace %q: %v
• could not find valid configmap %q from namespace %q: %v - U
• could not find valid mutatingWebhookConfiguration %q from cl

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/ffe5baa13f5ec819. Report an issue: GitHub.