{"record":{"id":"443f67091e70124d","repo":"cilium/cilium","slug":"failed-to-get-namespace-store-w","errorCode":null,"errorMessage":"failed to get namespace store: %w","messagePattern":"failed to get namespace store: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/clustermesh/namespace/namespace.go","lineNumber":49,"sourceCode":"}\n\ntype manager struct {\n\tlogger *slog.Logger\n\tcfg    Config\n\tstore  resource.Store[*slim_corev1.Namespace]\n}\n\nfunc newManager(params managerParams) *manager {\n\tm := &manager{\n\t\tlogger: params.Logger,\n\t\tcfg:    params.Config,\n\t}\n\n\tparams.Lifecycle.Append(cell.Hook{\n\t\tOnStart: func(ctx cell.HookContext) error {\n\t\t\tstore, err := params.Namespaces.Store(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to get namespace store: %w\", err)\n\t\t\t}\n\t\t\tm.store = store\n\t\t\treturn nil\n\t\t},\n\t})\n\n\treturn m\n}\n\n// IsGlobalNamespaceByObject determines whether the given namespace should be treated as a global\n// namespace based on its annotations and the provided configuration.\nfunc (m *manager) IsGlobalNamespaceByObject(ns *slim_corev1.Namespace) bool {\n\tif ns == nil {\n\t\treturn false\n\t}\n\t// Get annotations for the namespace.\n\t// If annotated with \"clustermesh.cilium.io/global\", supercede the default config.\n\tannotations := ns.GetAnnotations()","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/clustermesh/namespace/namespace.go#L31-L67","documentation":"At cell startup the namespace manager obtains a named-resource store of Kubernetes namespaces; if Namespaces.Store(ctx) fails, the hook aborts startup with this wrapped error. The underlying cause (ctx err) is chained via %w.","triggerScenarios":"Hive cell OnStart when params.Namespaces.Store(ctx) returns an error — typically the backing k8s client/watch factory failed to initialize or the context was canceled during startup.","commonSituations":"API server unreachable at startup; RBAC denying list/watch on namespaces; context deadline exceeded because k8s client never became ready; agent shutting down concurrently.","solutions":["Check k8s API server connectivity and kubeconfig from the agent pod","Verify RBAC allows list/watch on namespaces (clustermesh namespace Role/ClusterRole)","Inspect the wrapped cause in logs for the root error","Restart the agent once the API server is reachable"],"exampleFix":"# before: missing RBAC\n# after: grant access\nkind: ClusterRole\nrules:\n- apiGroups: [\"\"]\n  resources: [\"namespaces\"]\n  verbs: [\"list\", \"watch\"]","handlingStrategy":"retry","validationCode":"if err := k8sClient.Discovery().ServerVersion(); err != nil {\n    return fmt.Errorf(\"k8s API unreachable before start: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// hive retries via lifecycle; wrap startup\nif err := start(); err != nil {\n    if strings.Contains(err.Error(), \"failed to get namespace store\") {\n        return retryWithBackoff(start)\n    }\n    return err\n}","preventionTips":["Pre-flight check API server reachability before agent start","Verify namespaces list/watch RBAC","Set generous startup contexts/deadlines","Alert on cell OnStart failures"],"tags":["clustermesh","kubernetes","startup","rbac"],"backgroundTag":"k8s-api-unavailable","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}