istio/istio · error

expecting a workload namespace

Error message

expecting a workload namespace

What it means

Second validator in `istioctl x workload group create` (istioctl/pkg/workload/workload.go:134): after the name check passes, the namespace flag must also be non-empty because the generated WorkloadGroup manifest embeds metadata.namespace. Raised as `expecting a workload namespace` before any output is produced.

Source

Thrown at istioctl/pkg/workload/workload.go:134

	}
	entryCmd.AddCommand(configureCommand(ctx))
	return entryCmd
}

func createCommand(ctx cli.Context) *cobra.Command {
	createCmd := &cobra.Command{
		Use:   "create",
		Short: "Creates a WorkloadGroup resource that provides a template for associated WorkloadEntries",
		Long: `Creates a WorkloadGroup resource that provides a template for associated WorkloadEntries.
The default output is serialized YAML, which can be piped into 'kubectl apply -f -' to send the artifact to the API Server.`,
		Example: "  istioctl x workload group create --name foo --namespace bar --labels app=foo,bar=baz " +
			"--ports grpc=3550,http=8080 --annotations annotation=foobar --serviceAccount sa",
		Args: func(cmd *cobra.Command, args []string) error {
			if name == "" {
				return fmt.Errorf("expecting a workload name")
			}
			if namespace == "" {
				return fmt.Errorf("expecting a workload namespace")
			}
			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			u := &unstructured.Unstructured{
				Object: map[string]any{
					"apiVersion": gvk.WorkloadGroup.GroupVersion(),
					"kind":       gvk.WorkloadGroup.Kind,
					"metadata": map[string]any{
						"name":      name,
						"namespace": namespace,
					},
				},
			}
			spec := &networkingv1alpha3.WorkloadGroup{
				Metadata: &networkingv1alpha3.WorkloadGroup_ObjectMeta{
					Labels:      convertToStringMap(resourceLabels),
					Annotations: convertToStringMap(annotations),

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Pass the namespace explicitly: `istioctl x workload group create --name foo --namespace bar`
2. Or set the ambient default: `kubectl config set-context --current --namespace=bar` before re-running (if your istioctl honors it)
3. Validate both NAME and NAMESPACE variables in the calling script first

Example fix

# before
istioctl x workload group create --name foo
# after
istioctl x workload group create --name foo --namespace bar

: "${NAME:?--name required}"; : "${NAMESPACE:?--namespace required}"
istioctl x workload group create --name "$NAME" --namespace "$NAMESPACE"

When it happens

Trigger: `istioctl x workload group create --name foo` with no -n/--namespace and no default; namespace flag empty because the shell variable expanded to nothing.

Common situations: Unlike core istioctl commands this experimental command does not fall back to the kubeconfig default namespace, surprising users; script variables unset; namespace typo'd into another flag.

Related errors

• expecting a workload name
• expecting a WorkloadGroup artifact file or the name and name
• expecting an output directory
• the flags --internalIP and --externalIP are mutually exclusi
• must specify a waypoint name or delete all using --all or de

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/34d1fdcff06c6856. Report an issue: GitHub.