istio/istio · error

failed to fetch mesh config: %v

Error message

failed to fetch mesh config: %v

What it means

describePeerAuthentication() first loads the mesh config (mainly to learn meshCfg.RootNamespace) before listing PeerAuthentications. This error wraps any failure from getMeshConfig(): the istio configmap could not be read, lacks the mesh key, or its YAML failed to parse. The underlying cause is in the wrapped error text.

Source

Thrown at istioctl/pkg/describe/describe.go:1442

		}
	}
	return false, fmt.Errorf("no container %q in pod", containerName)
}

// describePeerAuthentication fetches all PeerAuthentication in workload and root namespace.
// It lists the ones applied to the pod, and the current active mTLS mode.
// When the client doesn't have access to root namespace, it will only show workload namespace Peerauthentications.
func describePeerAuthentication(
	writer io.Writer,
	kubeClient kube.CLIClient,
	configClient istioclient.Interface,
	workloadNamespace string,
	podsLabels klabels.Set,
	istioNamespace string,
) error {
	meshCfg, err := getMeshConfig(kubeClient, istioNamespace)
	if err != nil {
		return fmt.Errorf("failed to fetch mesh config: %v", err)
	}

	workloadPAList, err := configClient.SecurityV1().PeerAuthentications(workloadNamespace).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("failed to fetch workload namespace PeerAuthentication: %v", err)
	}

	rootPAList, err := configClient.SecurityV1().PeerAuthentications(meshCfg.RootNamespace).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("failed to fetch root namespace PeerAuthentication: %v", err)
	}

	allPAs := append(rootPAList.Items, workloadPAList.Items...)

	var cfgs []*config.Config
	for _, pa := range allPAs {
		cfg := crdclient.TranslateObject(pa, config.GroupVersionKind(pa.GroupVersionKind()), "")
		cfgs = append(cfgs, &cfg)

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Reproduce directly: kubectl get configmap -n <istio-ns> to see whether istio or istio-<rev> exists
2. Pass the matching --revision <tag> when the install is revisional
3. Pass --istioNamespace if Istio is not in istio-system
4. See errors for the wrapped cause (missing key / parse failure) and fix the configmap content

if err := describePeerAuthentication(w, kubeClient, configClient, ns, labels, istioNS); err != nil {
	if strings.Contains(err.Error(), "failed to fetch mesh config") {
		// configmap problem: guide user to the concrete cause (missing/invalid istio configmap)
		return fmt.Errorf("cannot read mesh config from %q - check --revision and --istioNamespace: %w", istioNS, err)
	}
	return err
}

When it happens

Trigger: ConfigMap istio (or istio-<revision>) missing from the Istio namespace; --revision tag not matching the installed configmap name; kubeconfig lacking get configmaps permission; malformed mesh YAML in the configmap.

Common situations: istioctl installed separately from a revisioned Istio install so the user forgets --revision; custom Istio namespace not passed via --istioNamespace; hand-edited mesh configmaps.

Related errors

• could not read configmap %q from namespace %q: %v
• missing config map key %q
• could not read valid configmap %q from namespace %q: %v - Us
• missing configuration map key %q
• failed to fetch workload namespace PeerAuthentication: %v

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/99fd8610eebf6f21. Report an issue: GitHub.