istio/istio · error

unsupported kind %v

Error message

unsupported kind %v

What it means

Thrown by ReferenceSet.internal (references.go:52-62), the shared resolver for Gateway API policy references in istiod: the reference's group/kind, after NormalizeReference, has no registered collection in the ReferenceSet. Only Service, ServiceEntry, ConfigMap, and Secret are registered (gateway/controller.go:226-231), so any other targetRef/caCertificateRef kind — HTTPRoute, Gateway, MeshService, InferencePool, etc. — yields 'unsupported kind %v'. Callers typically surface it in policy status (e.g. BackendTLSPolicy checks strings.Contains(err.Error(), "unsupported kind") to map it to BackendTLSPolicyReasonInvalidKind).

Source

Thrown at pilot/pkg/config/kube/gatewaycommon/references.go:56

}

func (s ReferenceSet) LocalPolicyTargetRef(ctx krt.HandlerContext, ref gatewayv1.LocalPolicyTargetReference, localNamespace string) (any, error) {
	return s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)
}

func (s ReferenceSet) XLocalPolicyTargetRef(ctx krt.HandlerContext, ref gatewayx.LocalPolicyTargetReference, localNamespace string) (any, error) {
	return s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)
}

func (s ReferenceSet) LocalPolicyRef(ctx krt.HandlerContext, ref gatewayv1.LocalObjectReference, localNamespace string) (any, error) {
	return s.internal(ctx, string(ref.Name), string(ref.Group), string(ref.Kind), localNamespace)
}

func (s ReferenceSet) internal(ctx krt.HandlerContext, name, group, kind, localNamespace string) (any, error) {
	t := NormalizeReference(&group, &kind, config.GroupVersionKind{})
	lookup, f := s.ErasedCollections[t]
	if !f {
		return nil, fmt.Errorf("unsupported kind %v", kind)
	}
	if v, ok := lookup(ctx, name, localNamespace); ok {
		return v, nil
	}
	return nil, fmt.Errorf("reference %v/%v (of kind %v) not found", localNamespace, name, kind)
}

func NewReferenceSet(opts ...func(r *ReferenceSet)) *ReferenceSet {
	r := &ReferenceSet{ErasedCollections: make(map[config.GroupVersionKind]func(ctx krt.HandlerContext, name, namespace string) (any, bool))}
	for _, opt := range opts {
		opt(r)
	}
	return r
}

func AddReference[T runtime.Object](c krt.Collection[T]) func(r *ReferenceSet) {
	return func(r *ReferenceSet) {
		g := schematypes.MustGVKFromType[T]()

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Use one of the four resolvable kinds: Service, ServiceEntry, ConfigMap, Secret — with correct groups ("", networking.istio.io, "", "")
2. Fix typos and casing in kind, and use group: "" (not core/v1) for core kinds
3. Check the policy's status conditions — this error is usually reported there rather than crashing istiod

Example fix

# before
targetRefs:
- group: networking.istio.io
  kind: MeshService
  name: reviews

# after
targetRefs:
- group: ""
  kind: Service
  name: reviews

resolvable := map[string]string{"Service": "", "ServiceEntry": "networking.istio.io", "ConfigMap": "", "Secret": ""}
if g, ok := resolvable[string(ref.Kind)]; !ok || g != string(ref.Group) {
    return fmt.Errorf("reference kind %s/%s cannot be resolved (supported: Service, ServiceEntry, ConfigMap, Secret)", ref.Group, ref.Kind)
}

func isResolvableRefKind(group, kind string) bool {
    switch kind {
    case "Service", "ConfigMap", "Secret":
        return group == ""
    case "ServiceEntry":
        return group == "networking.istio.io"
    }
    return false
}

refo, err := references.XLocalPolicyTargetRef(ctx, t, ns)
if err != nil {
    if strings.Contains(err.Error(), "unsupported kind") {
        // permanent config error: surface on the policy status, do not retry
        conds[accepted].error = &ConfigError{Reason: invalidKind, Message: err.Error()}
    } else if strings.Contains(err.Error(), "not found") {
        // target may appear later: leave for re-reconcile on collection updates
    }
}

When it happens

Trigger: Any policy reference whose kind is not Service/ServiceEntry/ConfigMap/Secret: e.g. BackendTLSPolicy validation.caCertificateRefs with kind: HTTPRoute, or a targetRef to kind: MeshService / kind: InferencePool / kind: Gateway. The map lookup at references.go:54 misses before any object fetch is attempted.

Common situations: Targeting experimental kinds (MeshService, InferencePool) not yet resolvable by this ReferenceSet; wrong group making NormalizeReference fail to find the schema (e.g. kind: Service with group: core instead of ''); typos in kind ('Services', 'ServiceEntries').

Related errors

• PolicyReasonTargetNotFound
• BackendTLSPolicyReasonInvalidKind
• ListenerReasonUnsupportedProtocol
• unknown infrastructure parameters type %v/%v
• protocol %v requires a port to be set

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/0ae875368b16265a. Report an issue: GitHub.