{"record":{"id":"390bd14646a8bb36","repo":"cilium/cilium","slug":"unable-to-list-ccnp-pods-in-namespace-s-w","errorCode":null,"errorMessage":"unable to list ccnp pods in namespace %s: %w","messagePattern":"unable to list ccnp pods in namespace (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/connectivity/check/deployment.go","lineNumber":2944,"sourceCode":"\t\t\t\t\tct.lrpClientPods[lrpPod.Name] = Pod{\n\t\t\t\t\t\tK8sClient: ct.client,\n\t\t\t\t\t\tPod:       lrpPod.DeepCopy(),\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif ct.Features[features.CCNP].Enabled {\n\n\t\tnamespaces := []string{ccnpTestNamespace1, ccnpTestNamespace2}\n\t\tfor _, ns := range namespaces {\n\t\t\tif err := WaitForDeployment(ctx, ct, ct.clients.src, ns, ccnpDeploymentName); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tccnpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: \"kind=\" + kindCCNPName})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unable to list ccnp pods in namespace %s: %w\", ns, err)\n\t\t\t}\n\t\t\tfor _, ccnpPod := range ccnpPods.Items {\n\t\t\t\tct.ccnpTestPods[ns] = Pod{\n\t\t\t\t\tK8sClient: ct.client,\n\t\t\t\t\tPod:       ccnpPod.DeepCopy(),\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tclientPods, err := ct.client.ListPods(ctx, ct.params.TestNamespace, metav1.ListOptions{LabelSelector: \"kind=\" + kindClientName})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to list client pods: %w\", err)\n\t}\n\n\tfor _, pod := range clientPods.Items {\n\t\tif strings.Contains(pod.Name, clientCPDeployment) {\n\t\t\tct.clientCPPods[pod.Name] = Pod{","sourceCodeStart":2926,"sourceCodeEnd":2962,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/connectivity/check/deployment.go#L2926-L2962","documentation":"For CCNP (CiliumClusterwideNetworkPolicy) tests, after waiting for the ccnp deployment in each namespace the test lists ccnp pods with the kind=<ccnpName> label to register test targets. This error wraps the ListPods failure with both namespace and underlying cause, scoped per-namespace so the failing one is identifiable.","triggerScenarios":"ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: \"kind=\" + kindCCNPName}) returns non-nil for a specific namespace ns: RBAC denial in that namespace, namespace deleted during iteration, or API error.","commonSituations":"Test namespaces (usually two for multi-cluster) cleaned up concurrently; service account scoped to only one namespace but the test iterates several; API throttling during many sequential ListPods calls.","solutions":["Check which namespace is named in the error and run kubectl -n <ns> get pods -l kind=<ccnpName>","Verify pods list RBAC in that specific namespace: kubectl auth can-i list pods -n <ns>","Ensure no concurrent cilium-cli runs/cleanup are deleting the test namespaces","Retry the suite once API server responsiveness is restored"],"exampleFix":"// before\nError: unable to list ccnp pods in namespace cilium-test-2: pods is forbidden\n// after\nkubectl auth can-i list pods -n cilium-test-2   # must be yes\nkubectl create rolebinding ccnp-lister -n cilium-test-2 --clusterrole=pod-lister --user=<user>","handlingStrategy":"try-catch","validationCode":"for ns in <TestNamespace> <otherTestNs>; do\n  kubectl auth can-i list pods -n $ns || echo \"missing pod-list RBAC in $ns\"\n  kubectl get ns $ns >/dev/null || echo \"namespace $ns missing\"\ndone","typeGuard":null,"tryCatchPattern":"ccnpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: \"kind=\" + kindCCNPName})\nif err != nil {\n    if apierrors.IsNotFound(err) {\n        // this specific namespace vanished; skip or recreate it\n        continue\n    }\n    return fmt.Errorf(\"ccnp pod listing failed in %s: %w\", ns, err)\n}","preventionTips":["Ensure RBAC covers every namespace the test iterates (multi-cluster creates several)","Serialize CI jobs that share the same test namespaces","Per-namespace RBAC smoke checks before the policy test phase"],"tags":["kubernetes","cilium-cli","network-policy","pods"],"backgroundTag":"kubernetes-pod-list-forbidden","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}