{"record":{"id":"6da6c50fd36df27e","repo":"crowdsecurity/crowdsec","slug":"kubernetes-informer-unauthorized-for-namespace-q","errorCode":null,"errorMessage":"kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w","messagePattern":"kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kubernetes/run.go","lineNumber":104,"sourceCode":"\t\tinformers.WithTweakListOptions(func(o *metav1.ListOptions) {\n\t\t\t// We set the LabelSelector on the ListOptions to filter pods at the\n\t\t\t// API level, so we only get events for pods that match our\n\t\t\t// selector. This is more efficient than getting all pod events and\n\t\t\t// filtering them in our event handlers.\n\t\t\to.LabelSelector = s.config.Selector\n\t\t}),\n\t)\n\tinf := f.Core().V1().Pods().Informer()\n\tif err := inf.SetWatchErrorHandler(func(_ *cache.Reflector, watchErr error) {\n\t\tfields := log.Fields{\n\t\t\t\"namespace\": s.config.Namespace,\n\t\t\t\"selector\":  s.config.Selector,\n\t\t\t\"error\":     watchErr,\n\t\t}\n\t\tif apierrors.IsUnauthorized(watchErr) {\n\t\t\ts.logger.WithFields(fields).Error(\"kubernetes informer received Unauthorized, forcing datasource restart\")\n\t\t\tselect {\n\t\t\tcase watchErrCh <- fmt.Errorf(\"kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w\", s.config.Namespace, s.config.Selector, s.config.UniqueId, watchErr):\n\t\t\tdefault:\n\t\t\t}\n\t\t\tcancelInformer()\n\t\t\treturn\n\t\t}\n\t\ts.logger.WithFields(fields).Warn(\"kubernetes informer watch error\")\n\t}); err != nil {\n\t\treturn fmt.Errorf(\"while setting watch error handler for namespace=%q selector=%q: %w\", s.config.Namespace, s.config.Selector, err)\n\t}\n\n\t// We ignore the ResourceEventHandlerRegistration returned by\n\t// AddEventHandler since we don't need to remove the handlers until shutdown,\n\t// and we will stop the entire informer at that time.\n\ts.logger.WithFields(log.Fields{\n\t\t\"namespace\": s.config.Namespace,\n\t\t\"selector\":  s.config.Selector,\n\t}).Info(\"adding kubernetes event handler\")\n\t_, err = inf.AddEventHandler(cache.ResourceEventHandlerFuncs{","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kubernetes/run.go#L86-L122","documentation":"The pod informer's watch error handler reports that the kubernetes API rejected the watch as Unauthorized (expired/invalid credentials). The error is sent to watchErrCh so Stream restarts the datasource with fresh credentials.","triggerScenarios":"Thrown at pkg/acquisition/modules/kubernetes/run.go:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Renew the kubeconfig or service-account credentials","Verify RBAC allows list/watch on pods in the namespace","Check that the token has not expired; restart crowdsec to re-authenticate"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}