istio/istio · error

failed to create injection webhook: %v

Error message

failed to create injection webhook: %v

What it means

Error "failed to create injection webhook: %v" thrown in istio/istio.

Source

Thrown at pilot/pkg/bootstrap/sidecarinjector.go:88

		watcher = inject.NewConfigMapWatcher(s.kubeClient, args.Namespace, configMapName, "config", "values")
	} else {
		log.Infof("Skipping sidecar injector, template not found")
		return nil, nil
	}

	log.Info("initializing sidecar injector")

	parameters := inject.WebhookParameters{
		Watcher:      watcher,
		Env:          s.environment,
		Mux:          s.httpsMux,
		Revision:     args.Revision,
		MultiCluster: s.multiclusterController,
	}

	wh, err := inject.NewWebhook(parameters)
	if err != nil {
		return nil, fmt.Errorf("failed to create injection webhook: %v", err)
	}
	// Patch cert if a webhook config name is provided.
	// This requires RBAC permissions - a low-priv Istiod should not attempt to patch but rely on
	// operator or CI/CD
	if features.InjectionWebhookConfigName != "" {
		s.addStartFunc("injection patcher", func(stop <-chan struct{}) error {
			// No leader election - different istiod revisions will patch their own cert.
			// update webhook configuration by watching the cabundle
			patcher, err := webhooks.NewWebhookCertPatcher(s.kubeClient, args.Revision, webhookName, s.istiodCertBundleWatcher)
			if err != nil {
				log.Errorf("failed to create webhook cert patcher: %v", err)
				return nil
			}

			go patcher.Run(stop)
			return nil
		})
	}

View on GitHub (pinned to 8dc789c5cf)

When it happens

Trigger: Thrown at pilot/pkg/bootstrap/sidecarinjector.go:88 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/00119864f31e5919. Report an issue: GitHub.