istio/istio · error

failed to get injection config from mutatingWebhookConfigura

Error message

failed to get injection config from mutatingWebhookConfigurations and injection configmap - check injection configmap or pass --revision flag

What it means

kube-inject resolves its parameters from the mutating webhook configuration first, then falls back to the injection configmap. This error is raised when the result has neither a usable external injector nor a mesh config (injector.client == nil && meshConfig == nil) - i.e. every source of injection configuration came back empty, so there is nothing to template a sidecar from.

Source

Thrown at istioctl/pkg/kubeinject/kubeinject.go:577

			var valuesConfig string
			var sidecarTemplate inject.RawTemplates
			var meshConfig *meshconfig.MeshConfig
			rev := cliContext.RevisionOrDefault(opts.Revision)
			// if the revision is "default", render templates with an empty revision
			if rev == util.DefaultRevisionName {
				rev = ""
			}
			injectorAddress := centralOpts.Xds
			index := strings.IndexByte(injectorAddress, ':')
			if index != -1 {
				injectorAddress = injectorAddress[:index]
			}
			injector, meshConfig, err := setupKubeInjectParameters(cliContext, &sidecarTemplate, &valuesConfig, rev, injectorAddress)
			if err != nil {
				return err
			}
			if injector.client == nil && meshConfig == nil {
				return fmt.Errorf(
					"failed to get injection config from mutatingWebhookConfigurations and injection configmap - " +
						"check injection configmap or pass --revision flag",
				)
			}
			var warnings []string
			templs, err := inject.ParseTemplates(sidecarTemplate)
			if err != nil {
				return err
			}
			vc, err := inject.NewValuesConfig(valuesConfig)
			if err != nil {
				return err
			}
			retval := inject.IntoResourceFile(injector, templs, vc, rev, meshConfig,
				reader, writer, func(warning string) {
					warnings = append(warnings, warning)
				})
			if len(warnings) > 0 {

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Pass --revision matching an installed revision so the webhook/configmap lookup hits real objects
2. Verify a control plane exists: kubectl get pods,mutatingwebhookconfigurations -l istio.io/rev=<rev> and kubectl get cm istio-sidecar-injector-<rev> -n <ns>
3. Point -i at the actual Istio namespace
4. Provide config out-of-band: --injectConfigFile plus --meshConfigFile/--valuesFile so no cluster reads are needed

Example fix

# before
istioctl kube-inject -f app.yaml   # no revision, nothing found
# after
kubectl get mwc -L istio.io/rev
istioctl kube-inject -f app.yaml -i istio-system --revision v1-21-0

# fail fast when neither injection source exists
NS=istio-system; REV=${REV:-}
kubectl get mwc -l istio.io/rev=${REV:-default} -o name | grep -q . || \
kubectl get cm istio-sidecar-injector${REV:+-$REV} -n "$NS" >/dev/null || \
{ echo 'no webhook and no injector configmap; aborting' >&2; exit 1; }

When it happens

Trigger: setupKubeInjectParameters returns (nil-client injector, nil meshConfig, nil error): the webhook lookup failed (or matched nothing), the configmap fallback produced nothing usable, and no IOP/file inputs were given. Typically: no Istio control plane reachable for the selected revision plus missing/empty injector configmap.

Common situations: Running kube-inject against the wrong cluster or namespace; --revision pointing at a non-existent revision so neither webhook nor istio-sidecar-injector-<rev> exists; partially uninstalled Istio.

Related errors

• could not find valid configmap %q from namespace %q: %v - U
• could not find valid mutatingWebhookConfiguration %q from cl
• could not find valid configmap %q from namespace %q: %v - U
• missing configuration map key %q in %q
• unable to convert data from configmap %q: %v

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/c5d0f624d806067c. Report an issue: GitHub.