{"record":{"id":"70d8b4a41a83d791","repo":"cilium/cilium","slug":"failed-to-get-nodes-w","errorCode":null,"errorMessage":"failed to get nodes: %w","messagePattern":"failed to get nodes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":3634,"sourceCode":"\tcmd.Flags().IntVar(&options.CopyRetryLimit,\n\t\toptionPrefix+\"copy-retry-limit\", DefaultCopyRetryLimit,\n\t\t\"Retry limit for file copying operations. If set to -1, copying will be retried indefinitely. Useful for collecting sysdump while on unreliable connection.\")\n\n\thooks.AddSysdumpFlags(cmd.Flags())\n}\n\n// formatMetricsAsTable formats the raw metrics JSON into a table format like kubectl top nodes\nfunc (c *Collector) formatNodeMetricsAsTable(rawMetrics string) (string, error) {\n\t// Parse the metrics JSON\n\tvar nodeMetrics metricsapi.NodeMetricsList\n\tif err := json.Unmarshal([]byte(rawMetrics), &nodeMetrics); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to parse metrics JSON: %w\", err)\n\t}\n\n\t// Get node information to calculate percentages\n\tnodes, err := c.Client.ListNodes(context.Background(), metav1.ListOptions{})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get nodes: %w\", err)\n\t}\n\n\t// Create a map of node names to their capacity\n\tnodeCapacities := make(map[string]corev1.ResourceList)\n\tfor _, node := range nodes.Items {\n\t\tnodeCapacities[node.Name] = node.Status.Capacity\n\t}\n\n\tvar sb strings.Builder\n\ttw := tabwriter.NewWriter(&sb, 0, 0, 2, ' ', 0)\n\tfmt.Fprintln(tw, \"NAME\\tCPU(cores)\\tCPU(%)\\tMEMORY(bytes)\\tMEMORY(%)\")\n\n\tfor _, metric := range nodeMetrics.Items {\n\t\tname := metric.Name\n\n\t\t// Get current usage\n\t\tcpuUsage := metric.Usage[corev1.ResourceCPU]\n\t\tmemUsage := metric.Usage[corev1.ResourceMemory]","sourceCodeStart":3616,"sourceCodeEnd":3652,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L3616-L3652","documentation":"After successfully parsing node metrics, `formatNodeMetricsAsTable` calls c.Client.ListNodes to fetch node capacities (CPU/memory) so usage percentages can be computed. Any Kubernetes API error from the node list call is wrapped as this error.","triggerScenarios":"Listing Node objects fails during sysdump table formatting: RBAC lacking `list nodes`, API server connection failures, timeouts, or context cancellation.","commonSituations":"Restricted kubeconfig user without cluster-scoped node read access; API server briefly unavailable; network issues between the CLI host and the cluster; expired credentials/tokens.","solutions":["Grant the current identity `list nodes` permission (nodes are cluster-scoped; check with `kubectl auth can-i list nodes`)","Verify `kubectl get nodes` works with the same kubeconfig to rule out connectivity/auth issues","Renew expired credentials or fix the kubeconfig context","Re-run the sysdump after the API server recovers if this was a transient failure"],"exampleFix":"// before: failing with restricted RBAC\n// after: verify permissions first\nkubectl auth can-i list nodes   # must print 'yes'\nkubectl get nodes","handlingStrategy":"try-catch","validationCode":"if allowed, _ := authClient.SelfSubjectAccessReviews().Create(ctx, &authv1.SelfSubjectAccessReview{\n\tSpec: authv1.SelfSubjectAccessReviewSpec{ResourceAttributes: &authv1.ResourceAttributes{Verb: \"list\", Resource: \"nodes\", Group: \"\"}},\n}); !allowed.Status.Allowed {\n\treturn errors.New(\"identity cannot list nodes; fix RBAC first\")\n}","typeGuard":"func isForbidden(err error) bool { return apierrors.IsForbidden(err) }","tryCatchPattern":"nodes, err := c.Client.ListNodes(ctx, metav1.ListOptions{})\nif err != nil {\n\tif apierrors.IsForbidden(err) { return \"\", fmt.Errorf(\"missing 'list nodes' RBAC: %w\", err) }\n\treturn \"\", fmt.Errorf(\"failed to get nodes: %w\", err)\n}","preventionTips":["Grant node list/get RBAC to diagnostic identities","Test with kubectl get nodes before running collectors","Renew credentials before long operations","Handle cluster-scoped resource permissions explicitly in CI roles"],"tags":["kubernetes","rbac","nodes","sysdump"],"backgroundTag":"kubernetes-api-request-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}