{"record":{"id":"9376049fbbbce5a6","repo":"cilium/cilium","slug":"namespace-of-service-q-conflict-with-pod-q","errorCode":null,"errorMessage":"namespace of service %q conflict with pod %q","messagePattern":"namespace of service %q conflict with pod %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hubble/cmd/observe/flows_filter.go","lineNumber":251,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\n// checkInconsistentNamespaces checks if the namespaces in pods and services make sense\n// i.e. it checks that we don't request a service in one namespace with pods in another namespace\nfunc checkInconsistentNamespaces(pods, services []string) error {\n\tfor _, pod := range pods {\n\t\tpodNs := namespaceFromName(pod)\n\t\tif podNs == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tfor _, svc := range services {\n\t\t\tif ns := namespaceFromName(svc); podNs != ns {\n\t\t\t\treturn fmt.Errorf(\"namespace of service %q conflict with pod %q\", svc, podNs)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\n// checkNamespaceConflicts checks for conflicts in namespaces, pods and services\nfunc (t *filterTracker) checkNamespaceConflicts(ff *flowpb.FlowFilter) error {\n\tif ff == nil {\n\t\treturn nil\n\t}\n\treturn errors.Join(t.ns.conflicts(ff.GetSourcePod()),\n\t\tt.ns.conflicts(ff.GetSourceService()),\n\t\tt.ns.conflicts(ff.GetDestinationPod()),\n\t\tt.ns.conflicts(ff.GetDestinationService()),\n\t\tt.srcNs.conflicts(ff.GetSourcePod()),\n\t\tt.srcNs.conflicts(ff.GetSourceService()),\n\t\tt.dstNs.conflicts(ff.GetDestinationPod()),","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/hubble/cmd/observe/flows_filter.go#L233-L269","documentation":"checkInconsistentNamespaces (called from checkNamespaceConflicts after flag parsing) compares the namespace of every set service (fqdn) filter with the namespace of every set pod filter. If a service's namespace differs from a pod's namespace, it reports this conflict, since a pod can only talk to services in its own namespace for these filters to make sense together.","triggerScenarios":"Setting both a pod filter (e.g. --from-pod ns1/pod) and a service/fqdn filter (e.g. --to-fqdn ns2.svc.cluster.local) whose namespaces differ; the check walks pods×services and fails on the first mismatch.","commonSituations":"Cross-namespace traffic debugging attempts with combined pod+service filters; fqdn given without namespace or in the wrong namespace; copy-paste of pod name and service name from different namespaces.","solutions":["Use a service in the same namespace as the pod filter, or drop one of the filters.","Fully qualify the fqdn with the correct namespace (e.g. my-svc.default.svc.cluster.local for a default-namespace pod).","Run two separate observe commands to inspect cross-namespace traffic."],"exampleFix":"// before\nhubble observe --from-pod default/app --to-fqdn other-ns.svc.cluster.local\n// after\nhubble observe --from-pod default/app --to-fqdn my-svc.default.svc.cluster.local","handlingStrategy":"validation","validationCode":"func sameNamespace(pods, services []string) bool {\n    for _, p := range pods {\n        pns := namespaceFromName(p)\n        if pns == \"\" { continue }\n        for _, s := range services {\n            if ns := namespaceFromName(s); ns != pns { return false }\n        }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"if err := checkNamespaceConflicts(...); err != nil {\n    if strings.Contains(err.Error(), \"conflict with pod\") {\n        // align service fqdn namespace or split queries\n    }\n    return err\n}","preventionTips":["Fully qualify fqdn filters with the pod's namespace (svc.ns.svc.cluster.local)","Avoid mixing pod and service filters across namespaces; run separate queries","Validate generated filter pairs in CI before invoking hubble"],"tags":["cli","filters","namespace","validation"],"backgroundTag":"flag-conflict","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}