{"record":{"id":"164e13cae45e630a","repo":"cilium/cilium","slug":"failed-to-collect-identity-entries-from-cilium-spi","errorCode":null,"errorMessage":"failed to collect identity entries from Cilium SPIRE server pods","messagePattern":"failed to collect identity entries from Cilium SPIRE server pods","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":2102,"sourceCode":"\t\t\t\tif err := c.WriteYAML(ciliumSPIREServerConfigMapFileName, v); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Cilium SPIRE server configuration: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tCreatesSubtasks: true,\n\t\t\tDescription:     \"Collecting the Cilium SPIRE server identity entries\",\n\t\t\tQuick:           false,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tp, err := c.Client.ListPods(ctx, c.Options.CiliumSPIRENamespace, metav1.ListOptions{\n\t\t\t\t\tLabelSelector: c.Options.CiliumSPIREServerLabelSelector,\n\t\t\t\t})\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to get identity entries from Cilium SPIRE server pods\")\n\t\t\t\t}\n\t\t\t\tif err := c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect identity entries from Cilium SPIRE server pods\")\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t}\n}\n\nfunc (c *Collector) getGatewayAPITasks() []Task {\n\treturn []Task{\n\t\t{\n\t\t\tDescription: \"Collecting GatewayClass entries\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tn := corev1.NamespaceAll\n\t\t\t\tv, err := c.Client.ListUnstructured(ctx, gatewayClass, &n, metav1.ListOptions{})\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect GatewayClass entries: %w\", err)\n\t\t\t\t}","sourceCodeStart":2084,"sourceCodeEnd":2120,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L2084-L2120","documentation":"Thrown when the SPIRE server pods were listed successfully but c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)) fails. This helper submits per-pod subtasks that exec into SPIRE server pods and fetch identity entries; a failure means those subtasks could not be created or the entry collection failed. The underlying error is not wrapped, so the specific cause is hidden.","triggerScenarios":"c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)) returns an error: no matching SPIRE server pods after filtering against the node list, exec into the pod failing (container not running, missing exec permission), or subtask submission failing.","commonSituations":"SPIRE server pod in CrashLoopBackOff or not Running; label selector not matching the actual pods; pod scheduled on nodes not present in the collected NodeList so FilterPods drops them; exec RBAC (pods/exec create) denied.","solutions":["Check SPIRE server pod status: kubectl get pods -n <ns> -l <CiliumSPIREServerLabelSelector> and confirm it is Running.","Verify the label selector in --cilium-spire-server-label-selector matches the actual pod labels.","Check exec permission: kubectl auth can-i create pods/exec -n <ns>.","Rerun the sysdump once the SPIRE server pod is healthy."],"exampleFix":"// before\nreturn fmt.Errorf(\"failed to collect identity entries from Cilium SPIRE server pods\")\n// after\nreturn fmt.Errorf(\"failed to collect identity entries from Cilium SPIRE server pods: %w\", err)","handlingStrategy":"try-catch","validationCode":"kubectl get pods -n \"$CILIUM_SPIRE_NAMESPACE\" -l \"$SPIRE_SERVER_LABEL_SELECTOR\" -o jsonpath='{.items[*].status.phase}'  # expect Running\nkubectl auth can-i create pods/exec -n \"$CILIUM_SPIRE_NAMESPACE\"","typeGuard":null,"tryCatchPattern":"if err := c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)); err != nil {\n    return fmt.Errorf(\"failed to collect identity entries from Cilium SPIRE server pods: %w\", err)\n}\n// catch: check for zero matched pods or exec/RBAC errors in the cause","preventionTips":["Ensure the SPIRE server pod is Running before collecting.","Confirm the server label selector matches deployed pod labels.","Grant pods/exec create permission cluster-wide.","Wrap the underlying error so diagnostics are preserved."],"tags":["kubernetes","cli","spire","pod-exec"],"backgroundTag":"pod-exec-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}