{"record":{"id":"b13d48d79c2dc5d2","repo":"cilium/cilium","slug":"error-while-creating-k8s-executor-w","errorCode":null,"errorMessage":"Error while creating k8s executor: %w","messagePattern":"Error while creating k8s executor: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/k8s/exec.go","lineNumber":59,"sourceCode":"\t// not be nil if we want to avoid a crash. Therefore, if one of them\n\t// encountered an error, return the other one.\n\tif errSPDY != nil && errWebsocket == nil {\n\t\treturn execWebsocket, nil\n\t}\n\tif errWebsocket != nil && errSPDY == nil {\n\t\treturn execSPDY, nil\n\t}\n\n\tif errSPDY != nil && errWebsocket != nil {\n\t\treturn nil, fmt.Errorf(\"Error while creating k8s executor: (websocket) %w, (spdy) %w\", errWebsocket, errSPDY)\n\t}\n\n\t// Default to the SPDY connection\n\texecFallback, errFallback := remotecommand.NewFallbackExecutor(execSPDY, execWebsocket, func(err error) bool {\n\t\treturn httpstream.IsUpgradeFailure(err) || httpstream.IsHTTPSProxyError(err)\n\t})\n\tif errFallback != nil {\n\t\treturn nil, fmt.Errorf(\"Error while creating k8s executor: %w\", errFallback)\n\t}\n\n\treturn execFallback, nil\n}\n\nfunc (c *Client) execInPodWithWriters(connCtx, killCmdCtx context.Context, p ExecParameters, stdout, stderr io.Writer) error {\n\treq := c.Clientset.CoreV1().RESTClient().Post().Resource(\"pods\").Name(p.Pod).Namespace(p.Namespace).SubResource(\"exec\")\n\n\tscheme := runtime.NewScheme()\n\tif err := corev1.AddToScheme(scheme); err != nil {\n\t\treturn fmt.Errorf(\"error adding to scheme: %w\", err)\n\t}\n\n\tparameterCodec := runtime.NewParameterCodec(scheme)\n\n\texecOpts := &corev1.PodExecOptions{\n\t\tCommand:   p.Command,\n\t\tContainer: p.Container,","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/k8s/exec.go#L41-L77","documentation":"This error wraps a failure from client-go's remotecommand.NewFallbackExecutor, which builds an executor that tries SPDY first and falls back to WebSocket for `kubectl exec`-style streaming into a pod. It is thrown when neither transport executor could be constructed — typically because the SPDY (and websocket) dialers could not be initialized from the client's REST config. The underlying cause is always available in the wrapped %w error.","triggerScenarios":"Calling Client.ExecInPodWithWriters / execInPodWithWriters which invokes newExecutor; NewFallbackExecutor(execSPDY, execWebsocket, ...) returns an error, e.g. an invalid or nil RESTClient config, or an unsupported TLS/proxy configuration preventing transport creation.","commonSituations":"A Cilium CLI run against a cluster where the kubeconfig yields a broken or empty rest.Config; corporate HTTPS proxies breaking the upgrade transport; client-go version where websocket fallback dialer construction fails.","solutions":["Inspect the wrapped error (%w) for the actual transport creation failure","Verify the kubeconfig/RESTConfig used to build the k8s client is valid and reachable","Upgrade cilium-cli / client-go to a version with a working SPDY+WebSocket fallback","Check TLS settings and proxy environment variables (HTTPS_PROXY) that can break the exec transport"],"exampleFix":"// before (no error surfaced to user)\nreturn nil, fmt.Errorf(\"Error while creating k8s executor: %w\", errFallback)\n// after (ensure config is validated earlier)\nif c.RESTConfig == nil || c.RESTConfig.Host == \"\" {\n\treturn nil, errors.New(\"k8s client has no valid REST config; check --context and kubeconfig\")\n}","handlingStrategy":"try-catch","validationCode":"if client == nil || client.RESTConfig == nil || client.RESTConfig.Host == \"\" {\n\treturn fmt.Errorf(\"k8s client not initialized: check --context and kubeconfig\")\n}","typeGuard":"func hasValidRestConfig(c *k8s.Client) bool {\n\tcfg := c.RESTConfig\n\treturn cfg != nil && cfg.Host != \"\"\n}","tryCatchPattern":"executor, err := newExecutor(...)\nif err != nil {\n\treturn fmt.Errorf(\"creating k8s executor (check kubeconfig/proxy/TLS): %w\", err)\n}","preventionTips":["Validate the kubeconfig and REST config before cluster operations","Test exec connectivity with a simple `kubectl exec` first","Audit HTTPS_PROXY/TLS env settings that can break upgraded connections","Keep client-go and cilium-cli versions aligned"],"tags":["kubernetes","exec","spdy","websocket","client-go"],"backgroundTag":"k8s-exec-transport-creation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}