istio/istio · error

registration of WorkloadEntry namespace mismatch: %q vs %q

Error message

registration of WorkloadEntry namespace mismatch: %q vs %q

What it means

ensureProxyCanControlEntry compares the proxy's certificate-derived namespace against the WorkloadEntry's namespace and rejects on mismatch (VALIDATE_WORKLOAD_ENTRY_IDENTITY on). The verified identity comes from the client cert SAN (spiffe://cluster/ns/<ns>/sa/<sa>); a workload may only control WorkloadEntries in the namespace its certificate proves.

Source

Thrown at pilot/pkg/autoregistration/controller.go:281

	err := c.onWorkloadConnect(entryName, proxy, conn.ConnectedAt(), autoCreate)
	if err != nil {
		log.Error(err)
	}
	return err
}

// ensureProxyCanControlEntry ensures the connected proxy's identity matches that of the WorkloadEntry it is associating with.
func ensureProxyCanControlEntry(proxy *model.Proxy, wle *config.Config) error {
	if !features.ValidateWorkloadEntryIdentity {
		// Validation disabled, skip
		return nil
	}
	if proxy.VerifiedIdentity == nil {
		return fmt.Errorf("registration of WorkloadEntry requires a verified identity")
	}
	if proxy.VerifiedIdentity.Namespace != wle.Namespace {
		return fmt.Errorf("registration of WorkloadEntry namespace mismatch: %q vs %q", proxy.VerifiedIdentity.Namespace, wle.Namespace)
	}
	spec := wle.Spec.(*v1alpha3.WorkloadEntry)
	if spec.ServiceAccount != "" && proxy.VerifiedIdentity.ServiceAccount != spec.ServiceAccount {
		return fmt.Errorf("registration of WorkloadEntry service account mismatch: %q vs %q", proxy.VerifiedIdentity.ServiceAccount, spec.ServiceAccount)
	}
	return nil
}

// onWorkloadConnect creates/updates WorkloadEntry of the connecting workload.
//
// If workload is using auto-registration, WorkloadEntry will be created automatically.
//
// If workload is not using auto-registration, WorkloadEntry must already exist.
func (c *Controller) onWorkloadConnect(entryName string, proxy *model.Proxy, conTime time.Time, autoCreate bool) error {
	if autoCreate {
		return c.registerWorkload(entryName, proxy, conTime)
	}
	return c.becomeControllerOf(entryName, proxy, conTime)

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Read the two quoted namespaces in the error: cert says X, entry says Y — move the WorkloadEntry to the cert's namespace, or re-provision the workload's identity for the entry's namespace
2. Re-bootstrap the VM/workload so its certificate matches the intended namespace
3. Keep onboarding manifests and identity provisioning in one pipeline to avoid drift

Example fix

# before
cert SAN: spiffe://cluster/ns/web/sa/vm-sa        # cert namespace = web
WorkloadEntry: metadata.namespace: prod            # entry namespace = prod -> mismatch
# after: align them
WorkloadEntry created in namespace web (or VM re-bootstrapped with prod-namespace identity)

// At onboarding time: assert entry namespace matches the workload's cert namespace
if entry.Namespace != certNamespace {
    return fmt.Errorf("WorkloadEntry %s is in namespace %q but workload cert is %q", entry.Name, entry.Namespace, certNamespace)
}

When it happens

Trigger: Proxy connects with a client cert for namespace A (SAN ns/A) but its metadata associates it with a WorkloadEntry in namespace B — cross-namespace certificate/resource mismatch trips the %q vs %q error.

Common situations: VM bootstrap files (token/certs) copied from a workload in another namespace; WorkloadEntry created in the wrong namespace during onboarding; renaming/re-homing a VM without re-issuing its identity; multi-tenant clusters where namespace discipline matters.

Related errors

• registration of WorkloadEntry service account mismatch: %q v
• registration of WorkloadEntry requires a verified identity
• mesh TLS does not support ECDH curves configuration
• not implemented on this platform
• empty request body

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/91dc7cacafe11f2e. Report an issue: GitHub.