{"record":{"id":"bbf823cd7fe40249","repo":"cilium/cilium","slug":"failed-to-collect-the-hubble-ui-deployment-w","errorCode":null,"errorMessage":"failed to collect the Hubble UI deployment: %w","messagePattern":"failed to collect the Hubble UI deployment: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":1075,"sourceCode":"\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\tfor i := range deployments.Items {\n\t\t\t\t\tif err := c.WriteYAML(hubbleRelayDeploymentFileName, &deployments.Items[i]); err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble Relay deployment %q: %w\", deployments.Items[i].Name, err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Hubble UI deployment\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tdeployments, err := c.Client.ListDeployment(ctx, c.Options.CiliumNamespace, metav1.ListOptions{\n\t\t\t\t\tLabelSelector: c.Options.HubbleUILabelSelector,\n\t\t\t\t})\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble UI deployment: %w\", err)\n\t\t\t\t}\n\t\t\t\tif len(deployments.Items) == 0 {\n\t\t\t\t\tc.logWarn(\"Deployment with label %q not found in namespace %q - this is expected if Hubble UI is not enabled\", c.Options.HubbleUILabelSelector, c.Options.CiliumNamespace)\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\tfor i := range deployments.Items {\n\t\t\t\t\tif err := c.WriteYAML(hubbleUIDeploymentFileName, &deployments.Items[i]); err != nil {\n\t\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble UI deployment %q: %w\", deployments.Items[i].Name, err)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Hubble generate certs cronjob\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tv, err := c.Client.GetCronJob(ctx, c.Options.CiliumNamespace, hubbleGenerateCertsCronJob, metav1.GetOptions{})","sourceCodeStart":1057,"sourceCodeEnd":1093,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L1057-L1093","documentation":"This error wraps an API error from ListDeployment for the Hubble UI deployment, selected by the Hubble UI label selector, during a sysdump. An empty result is warned and skipped; only a failing list API call reaches this wrapper.","triggerScenarios":"c.Client.ListDeployment(ctx, namespace, metav1.ListOptions{LabelSelector: c.Options.HubbleUILabelSelector}) returns a non-nil error inside the 'Collecting the Hubble UI deployment' task.","commonSituations":"RBAC denies deployment list; API server unreachable or timing out; invalid label selector (HTTP 400); wrong cluster/namespace.","solutions":["Check RBAC: kubectl auth can-i list deployments -n <cilium-namespace>.","Validate the Hubble UI label selector: kubectl get deployments -l '<selector>' -n <ns>.","Verify cluster connectivity and kubeconfig context.","Retry on transient API errors."],"exampleFix":"// before\nreturn fmt.Errorf(\"failed to collect the Hubble UI deployment: %w\", err)\n// after\nif apierrors.IsForbidden(err) {\n    c.logWarn(\"No permission to list Hubble UI deployments: %v\", err)\n    return nil\n}\nreturn fmt.Errorf(\"failed to collect the Hubble UI deployment: %w\", err)","handlingStrategy":"try-catch","validationCode":"kubectl auth can-i list deployments -n <cilium-namespace>\nkubectl get deployments -l '<hubble-ui-label-selector>' -n <cilium-namespace>","typeGuard":"func isForbiddenErr(err error) bool { return apierrors.IsForbidden(err) }","tryCatchPattern":"if err := task(ctx); err != nil {\n    if apierrors.IsForbidden(errors.Unwrap(err)) {\n        log.Println(\"RBAC denies listing Hubble UI deployments; skipping\")\n        return nil\n    }\n    return err\n}","preventionTips":["Grant deployments list RBAC before running sysdump.","Validate HubbleUILabelSelector syntax (a malformed selector yields HTTP 400).","Confirm Hubble UI is installed if its deployment is expected in the dump.","Verify kubeconfig context and API server health."],"tags":["kubernetes","cilium","hubble-ui","sysdump","deployment"],"backgroundTag":"kubernetes-rbac-forbidden","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}