istio/istio · error
not implemented on this platform
Error message
not implemented on this platform
What it means
validateHub (validation.go:388-398) checks spec.hub by constructing the reference '<hub>/pilot' and parsing it with go-containerregistry's name.NewRepository. The hub must be a valid OCI repository path: fully lowercase, no whitespace, no tag or digest components, valid DNS-style segments. Any violation returns 'bad hub: <parser detail>'.
Source
Thrown at cni/pkg/iptables/iptables_unspecified.go:25
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package iptables
import (
"errors"
"istio.io/istio/cni/pkg/config"
)
func AddInpodMarkIPRule(cfg *config.AmbientConfig) error {
return errors.New("not implemented on this platform")
}
func DelInpodMarkIPRule(cfg *config.AmbientConfig) error {
return errors.New("not implemented on this platform")
}
func AddLoopbackRoutes(cfg *config.AmbientConfig) error {
return errors.New("not implemented on this platform")
}
func DelLoopbackRoutes(cfg *config.AmbientConfig) error {
return errors.New("not implemented on this platform")
}
View on GitHub (pinned to 8dc789c5cf)
Solutions
- Lowercase the entire hub and strip any ':tag' or '@digest' suffix - those belong elsewhere in the image spec
- Verify the resulting reference resolves: run a manifest inspect (docker/crane) on '<hub>/pilot' from the same network
- Registry ports are legal in the form host:5000/path - keep that shape if you use one
Example fix
# before hub: gcr.io/MyOrg # after hub: gcr.io/myorg
Defensive patterns
Strategy: validation
Validate before calling
if _, err := name.NewRepository(hub + "/pilot"); err != nil {
return fmt.Errorf("hub %q invalid: %w", hub, err)
} Try / catch
validateHub returns a plain error; check err != nil and wrap 'bad hub:' output - the go-containerregistry detail explains exactly which character class failed.
Prevention
- Enforce lowercase-only registry paths in the repo that stores IstioOperator manifests
- Never paste a full image reference into hub - split hub vs tag before committing
- Smoke-test private hubs with a manifest inspect of <hub>/pilot from the cluster network
When it happens
Trigger: spec.hub values like 'gcr.io/MyOrg' (uppercase), 'docker.io/org:latest' (tag smuggled into the hub), a hub with spaces or a trailing slash, or a repository segment using invalid characters.
Common situations: Private registries with mixed-case project names (common on Harbor/GCR); air-gapped mirror misconfigurations; users pasting a full image reference into the hub field instead of just the registry/path prefix.
Related errors
- empty request body
- not implemented
- discovery address must be set to the proxy discovery service
- private key provider configuration is required
- cryptomb configuration is required
AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15).
Data as JSON: /api/errors/eb050ffbb1c40982.
Report an issue: GitHub.