{"record":{"id":"b8112e98a07e0f94","repo":"cilium/cilium","slug":"failed-to-check-for-cilium-daemonset-w","errorCode":null,"errorMessage":"failed to check for Cilium DaemonSet: %w","messagePattern":"failed to check for Cilium DaemonSet: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":3448,"sourceCode":"}\n\nfunc detectCiliumNamespace(k KubernetesClient) (string, error) {\n\tfor _, ns := range DefaultCiliumNamespaces {\n\t\tctx := context.Background()\n\t\tns, err := k.GetNamespace(ctx, ns, metav1.GetOptions{})\n\t\tif k8sErrors.IsNotFound(err) {\n\t\t\tcontinue\n\t\t}\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to detect Cilium namespace: %w\", err)\n\t\t}\n\n\t\t_, err = k.GetDaemonSet(ctx, ns.Name, \"cilium\", metav1.GetOptions{})\n\t\tif k8sErrors.IsNotFound(err) {\n\t\t\tcontinue\n\t\t}\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to check for Cilium DaemonSet: %w\", err)\n\t\t}\n\t\treturn ns.Name, nil\n\t}\n\treturn \"\", fmt.Errorf(\"failed to detect Cilium namespace, could not find Cilium installation in namespaces: %v\", DefaultCiliumNamespaces)\n}\n\nfunc detectCiliumOperatorNamespace(k KubernetesClient) (string, error) {\n\tfor _, ns := range DefaultCiliumNamespaces {\n\t\tctx := context.Background()\n\t\tns, err := k.GetNamespace(ctx, ns, metav1.GetOptions{})\n\t\tif k8sErrors.IsNotFound(err) {\n\t\t\tcontinue\n\t\t}\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to detect Cilium operator namespace: %w\", err)\n\t\t}\n\n\t\t_, err = k.GetDeployment(ctx, ns.Name, ciliumOperatorDeploymentName, metav1.GetOptions{})","sourceCodeStart":3430,"sourceCodeEnd":3466,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L3430-L3466","documentation":"While detecting the Cilium namespace, after confirming the namespace exists cilium-cli checks for the 'cilium' DaemonSet via GetDaemonSet. A non-NotFound error from that call aborts detection with this wrapped error. It signals an API failure while verifying the Cilium installation, distinct from 'not found' (which just continues to the next namespace).","triggerScenarios":"detectCiliumNamespace: GetNamespace succeeded for a candidate namespace, then k.GetDaemonSet(ns, \"cilium\") returns a non-NotFound error such as Forbidden, Timeout, or InternalError.","commonSituations":"RBAC allows namespace get but not daemonset get; API server degraded; etcd quorum loss causing internal errors; network interruption mid-detection.","solutions":["Check RBAC: kubectl auth can-i get daemonsets -n NAMESPACE","Verify API server health: kubectl get ds -n NAMESPACE cilium directly","If Cilium is genuinely absent (missing CRDs/operator), install it or pass the namespace explicitly","Retry once the control plane recovers"],"exampleFix":"// before\n_, err = k.GetDaemonSet(ctx, ns.Name, \"cilium\", metav1.GetOptions{})\n// after: log and continue scanning remaining namespaces\n_, err = k.GetDaemonSet(ctx, ns.Name, \"cilium\", metav1.GetOptions{})\nif err != nil && !k8sErrors.IsNotFound(err) {\n    log.Printf(\"skipping ns %s: %v\", ns.Name, err)\n    continue\n}","handlingStrategy":"try-catch","validationCode":"ok, err := authCanI(\"get\", \"daemonsets\", ns)\nif err != nil || !ok { return fmt.Errorf(\"RBAC: cannot get daemonsets in %s\", ns) }","typeGuard":"func isRBACDenied(err error) bool {\n    var ae *apierrors.StatusError\n    return errors.As(err, &ae) && ae.Status().Reason == metav1.StatusReasonForbidden\n}","tryCatchPattern":"_, err := k.GetDaemonSet(ctx, ns.Name, \"cilium\", metav1.GetOptions{})\nswitch {\ncase apierrors.IsNotFound(err):\n    continue // next candidate namespace\ncase isRBACDenied(err):\n    return fmt.Errorf(\"grant daemonset get RBAC in %s: %w\", ns.Name, err)\ncase err != nil:\n    return fmt.Errorf(\"api error checking cilium daemonset: %w\", err)\n}","preventionTips":["Pre-check daemonset get permissions in target namespaces","Confirm Cilium is actually installed before sysdump","Monitor API server health before long collection runs","Escape hatch: pass namespace explicitly to skip DaemonSet probing"],"tags":["kubernetes","cilium","daemonset","rbac"],"backgroundTag":"cilium-namespace-detection-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}