istio/istio · error

missing configuration map key %q

Error message

missing configuration map key %q

What it means

The istio MeshConfig ConfigMap was fetched successfully, but its Data map has no entry for the expected key ('mesh'), so there is no YAML to parse. The control plane normally writes the mesh config under that key; an empty, hand-edited, or foreign object that merely shares the configmap name triggers this.

Source

Thrown at istioctl/pkg/kubeinject/kubeinject.go:257

	if err != nil {
		return nil, err
	}

	if meshConfigMapName == defaultMeshConfigMapName && revision != "" {
		meshConfigMapName = fmt.Sprintf("%s-%s", defaultMeshConfigMapName, revision)
	}
	meshConfigMap, err := client.Kube().CoreV1().ConfigMaps(ctx.IstioNamespace()).Get(context.TODO(), meshConfigMapName, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("could not read valid configmap %q from namespace %q: %v - "+
			"Use --meshConfigFile or re-run "+command+" with `-i <istioSystemNamespace> and ensure valid MeshConfig exists",
			meshConfigMapName, ctx.IstioNamespace(), err)
	}
	// values in the data are strings, while proto might use a
	// different data type.  therefore, we have to get a value by a
	// key
	configYaml, exists := meshConfigMap.Data[configMapKey]
	if !exists {
		return nil, fmt.Errorf("missing configuration map key %q", configMapKey)
	}
	cfg, err := mesh.ApplyMeshConfigDefaults(configYaml)
	if err != nil {
		err = multierror.Append(err, fmt.Errorf("istioctl version %s cannot parse mesh config.  Install istioctl from the latest Istio release",
			version.Info.Version))
	}
	return cfg, err
}

// grabs the raw values from the ConfigMap. These are encoded as JSON.
func GetValuesFromConfigMap(ctx cli.Context, revision string) (string, error) {
	client, err := ctx.CLIClient()
	if err != nil {
		return "", err
	}

	if revision != "" {
		injectConfigMapName = fmt.Sprintf("%s-%s", defaultInjectConfigMapName, revision)

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Inspect the data keys: kubectl get cm istio -n <istio-ns> -o yaml and confirm a 'mesh' key exists
2. Restore the key by re-applying the Istio install (istioctl install / helm upgrade) or editing the configmap back
3. For revisioned installs check istio-<rev> instead, matching --revision
4. Work around with --meshConfigFile <mesh.yaml>

Example fix

# before (configmap with empty data)
kubectl get cm istio -n istio-system -o jsonpath='{.data}'  # {}
# after
kubectl edit cm istio -n istio-system   # re-add:
# data:
#   mesh: |-
#     defaultConfig: {}
# or regenerate via: istioctl install

# confirm the mesh key is present before invoking kube-inject
if ! kubectl get cm istio -n istio-system -o jsonpath='{.data.mesh}' | grep -q .; then
  echo "configmap istio has no mesh key" >&2; exit 1
fi
istioctl kube-inject -f app.yaml

When it happens

Trigger: meshConfigMap.Data[configMapKey] returns exists=false: someone created a placeholder istio configmap with no mesh key, the configmap was edited and the key removed, or a revision label mix-up resolved to an unrelated configmap object.

Common situations: Manual edits to the istio configmap that dropped the mesh key; GitOps applying a stripped-down configmap; copying a configmap from another cluster without its data.

Related errors

• could not read valid configmap %q from namespace %q: %v - Us
• failed to fetch mesh config: %v
• could not read configmap %q from namespace %q: %v
• missing config map key %q
• could not find valid configmap %q from namespace %q: %v - U

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/0714a22126066697. Report an issue: GitHub.