TIS0101 - Specified Namespace Cannot Be Found

The specified namespace cannot be found.

Recommendation: Ensure Specified Namespaces Exist

To avoid configuration errors, ensure that the namespaces specified in your Istio resources exist. Correct any typographical errors, remove non-existent namespaces, or create missing namespaces to apply policies correctly.

Examples

1. AuthorizationPolicy Refers to Non-Existent Namespace

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: access-policy
     namespace: example-namespace
   spec:
     rules:
     - from:
       - source:
           namespaces: ["non-existent-namespace"]

   Explanation: The AuthorizationPolicy refers to a source namespace non-existent-namespace that does not exist, making the rule ineffective for access control.

2. VirtualService with a Host in a Non-Existent Namespace

   apiVersion: networking.istio.io/v1beta1
   kind: VirtualService
   metadata:
     name: my-virtual-service
     namespace: example-namespace
   spec:
     hosts:
     - "my-service.non-existent-namespace.svc.cluster.local"
     http:
     - route:
       - destination:
           host: my-service.non-existent-namespace.svc.cluster.local

   Explanation: The VirtualService references a host in the non-existent-namespace, which does not exist, causing the routing rule to fail.

3. ServiceEntry Refers to a Non-Existent Namespace

   apiVersion: networking.istio.io/v1beta1
   kind: ServiceEntry
   metadata:
     name: external-service
     namespace: example-namespace
   spec:
     hosts:
     - "external-service.non-existent-namespace.svc.cluster.local"
     ports:
     - number: 80
       name: http
       protocol: HTTP

   Explanation: The ServiceEntry specifies a host in non-existent-namespace, which does not exist, preventing the configuration from being properly applied.

Recommendation

Remove the namespace from the list, correct any typographical errors, or create a new namespace.

1. Remove or Correct the Non-Existent Namespace

   Correct the namespace to an existing one or remove it if not needed.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: access-policy
     namespace: example-namespace
   spec:
     rules:
     - from:
       - source:
           namespaces: ["existing-namespace"]

2. Create the Missing Namespace

   If the namespace is intended to exist, create it before applying the configuration.

   kubectl create namespace non-existent-namespace

3. Update Hostnames in Configuration

   Update the hostnames in VirtualService or ServiceEntry to refer to a valid namespace.

   apiVersion: networking.istio.io/v1beta1
   kind: VirtualService
   metadata:
     name: my-virtual-service
     namespace: example-namespace
   spec:
     hosts:
     - "my-service.existing-namespace.svc.cluster.local"
     http:
     - route:
       - destination:
           host: my-service.existing-namespace.svc.cluster.local