{"record":{"id":"992e832493e2f58d","repo":"cilium/cilium","slug":"failed-to-get-logs-from-hubble-certgen-pods","errorCode":null,"errorMessage":"failed to get logs from Hubble certgen pods","messagePattern":"failed to get logs from Hubble certgen pods","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":1115,"sourceCode":"\t\t\t\t\t\treturn nil\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble generate certs cronjob: %w\", err)\n\t\t\t\t}\n\t\t\t\tif err := c.WriteYAML(hubbleGenerateCertsCronJobFileName, v); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble generate certs cronjob: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Hubble generate certs pod logs\",\n\t\t\tQuick:       false,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tp, err := c.Client.ListPods(ctx, c.Options.CiliumNamespace, metav1.ListOptions{\n\t\t\t\t\tLabelSelector: c.Options.HubbleGenerateCertsLabelSelector,\n\t\t\t\t})\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to get logs from Hubble certgen pods\")\n\t\t\t\t}\n\t\t\t\tif err := c.SubmitLogsTasks(FilterPods(p, c.NodeList), c.Options.LogsSinceTime, c.Options.LogsLimitBytes); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect logs from Hubble certgen pods\")\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Hubble cert-manager certificates\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\treturn c.GatherResourceUnstructured(\n\t\t\t\t\tctx,\n\t\t\t\t\tcertificate,\n\t\t\t\t\thubbleCertificatesFileName,\n\t\t\t\t\t\"hubble-relay-client-certs\",\n\t\t\t\t\t\"hubble-relay-server-certs\",\n\t\t\t\t\t\"hubble-server-certs\",","sourceCodeStart":1097,"sourceCodeEnd":1133,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L1097-L1133","documentation":"The 'Collecting the Hubble certgen pod logs' task first lists pods matching HubbleGenerateCertsLabelSelector in the Cilium namespace. This error is returned when that ListPods call fails; note the message is slightly misleading — no logs were attempted yet, the pod listing itself failed. Unlike elsewhere, the underlying error is not wrapped, so the message alone hides the cause.","triggerScenarios":"c.Client.ListPods(ctx, c.Options.CiliumNamespace, metav1.ListOptions{LabelSelector: c.Options.HubbleGenerateCertsLabelSelector}) returns an error — namespace missing, RBAC forbids pods list, or API server unreachable. NotFound-style failures on list usually surface as other errors; here any list error triggers it.","commonSituations":"Typo in --namespace so the Cilium namespace doesn't exist; service account without pods/list permission; network policy or VPN blocking API server; expired kubeconfig credentials.","solutions":["Run kubectl -n <CiliumNamespace> get pods -l <HubbleGenerateCertsLabelSelector> to reproduce outside cilium-cli.","Verify the namespace exists and the kubeconfig context is correct.","Check RBAC: kubectl auth can-i list pods -n <CiliumNamespace>.","If the certgen pods don't apply to your setup (no TLS cronjob method), treat this task's failure as non-blocking for the rest of the sysdump."],"exampleFix":"// before\ncilium-cli sysdump --namespace cilium   # pods list forbidden for current user\n// after\nkubectl auth can-i list pods -n cilium  # false -> bind the role\nkubectl create rolebinding sysdump-pods --clusterrole=view --user=$USER -n cilium","handlingStrategy":"validation","validationCode":"kubectl get ns \"$CILIUM_NS\" >/dev/null || { echo \"namespace missing\"; exit 1; }\nkubectl auth can-i list pods -n \"$CILIUM_NS\" || { echo \"RBAC: cannot list pods\"; exit 1; }\nkubectl -n \"$CILIUM_NS\" get pods -l \"$HUBBLE_CERTGEN_SELECTOR\" -o name","typeGuard":null,"tryCatchPattern":"if err := runSysdump(ctx, opts); err != nil {\n\tif strings.Contains(err.Error(), \"failed to get logs from Hubble certgen pods\") {\n\t\t// listing failed, not log collection; certgen logs are optional\n\t\tlog.Printf(\"skipping certgen pod logs: %v\", err)\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Confirm the namespace exists and context is correct before running cilium-cli.","Grant pods/list RBAC to the identity used for sysdumps.","Keep in mind the message hides the underlying cause — reproduce with kubectl to diagnose.","Certgen logs only matter with hubble.auto.tls.method=cronjob; otherwise ignore."],"tags":["kubernetes","rbac","pods","logs"],"backgroundTag":"k8s-pod-list-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}