{"record":{"id":"7d466a2e45df2f4c","repo":"cilium/cilium","slug":"failed-to-get-ciliumendpoints-by-namespace-index","errorCode":null,"errorMessage":"failed to get CiliumEndpoints by namespace index: %w","messagePattern":"failed to get CiliumEndpoints by namespace index: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ztunnel/reconciler/reconciler.go","lineNumber":115,"sourceCode":"\t\t\t\tcase ops.endpointEventCh <- &xds.EndpointEvent{\n\t\t\t\t\tType:           eventType,\n\t\t\t\t\tCiliumEndpoint: cep,\n\t\t\t\t}:\n\t\t\t\tcase <-ctx.Done():\n\t\t\t\t\treturn ctx.Err()\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\n\tcepStore, err := ops.ciliumEndpointResource.Store(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get CiliumEndpoint store from K8sCiliumEndpointsWatcher: %w\", err)\n\t}\n\tceps, err := cepStore.ByIndex(k8s.NamespaceIndex, namespace)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get CiliumEndpoints by namespace index: %w\", err)\n\t}\n\tfor _, cep := range ceps {\n\t\tselect {\n\t\tcase ops.endpointEventCh <- &xds.EndpointEvent{\n\t\t\tType:           eventType,\n\t\t\tCiliumEndpoint: cep,\n\t\t}:\n\t\tcase <-ctx.Done():\n\t\t\treturn ctx.Err()\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (ops *EnrollmentReconciler) Update(ctx context.Context, txn statedb.ReadTxn, rev statedb.Revision, ns *table.EnrolledNamespace) error {\n\tif err := ops.emitEndpointEvents(ctx, ns.Name, xds.CREATE); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ztunnel/reconciler/reconciler.go#L97-L133","documentation":"After obtaining the CiliumEndpoint store, Update lists CiliumEndpoints by the NamespaceIndex via cepStore.ByIndex(k8s.NamespaceIndex, namespace). This error wraps a failure of that indexed lookup, which normally only fails if the index is not registered or the store is in a bad state.","triggerScenarios":"Calling Update(namespace) when the cache's NamespaceIndex is missing/misconfigured on the CiliumEndpoint informer, or the store returned is not an Indexer with the expected index.","commonSituations":"Custom or refactored cache wiring that dropped the NamespaceIndex registration; using a plain store instead of the indexed informer store; version drift between istio/ztunnel and the k8s cache library.","solutions":["Verify the CiliumEndpoint informer is created with k8s.NamespaceIndex added via AddIndexers","Inspect the wrapped error for 'index with name namespace does not exist' and fix informer setup","Restart/recreate the informer store so indexes are rebuilt","Confirm the store is a cache.Indexer, not a plain cache.Store"],"exampleFix":"// before\ninformer := cache.NewSharedIndexInformer(...) // no indexers\n// after\ncache.NewSharedIndexInformer(...)\ninf.AddIndexers(cache.Indexers{k8s.NamespaceIndex: meta.NamespaceFunc})","handlingStrategy":"try-catch","validationCode":"// ensure the store is an Indexer with the namespace index before lookup\nindexer, ok := cepStore.(cache.Indexer)\nif !ok || indexer.IndexFuncs() == nil {\n    return fmt.Errorf(\"cepStore lacks indexers\")\n}\n// or: verify AddIndexers{k8s.NamespaceIndex: ...} was called on the informer","typeGuard":null,"tryCatchPattern":"ceps, err := cepStore.ByIndex(k8s.NamespaceIndex, namespace)\nif err != nil {\n    if strings.Contains(err.Error(), \"does not exist\") {\n        // rebuild informer with AddIndexers(k8s.NamespaceIndex)\n        return restartInformerWithIndexers(ctx)\n    }\n    return fmt.Errorf(\"failed to get CiliumEndpoints by namespace index: %w\", err)\n}","preventionTips":["Register k8s.NamespaceIndex via AddIndexers when constructing the CiliumEndpoint informer","Use the informer's GetIndexer(), never a plain cache.Store, for ByIndex lookups","Pin cache/client-go versions consistently across istio components","Add a startup self-check that lists by index once and fails fast"],"tags":["kubernetes","cilium","indexer"],"backgroundTag":"cache-index-not-registered","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}