{"record":{"id":"ce5b5b0c19120633","repo":"cilium/cilium","slug":"unable-to-create-apiext-k8s-client-w","errorCode":null,"errorMessage":"unable to create apiext k8s client: %w","messagePattern":"unable to create apiext k8s client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/k8s/client/cell.go","lineNumber":185,"sourceCode":"\tif s := os.Getenv(\"DISABLE_HTTP2\"); len(s) > 0 {\n\t\tclient.closeAllConns = defaultCloseAllConns\n\t} else {\n\t\tclient.closeAllConns = func() {\n\t\t\tutilnet.CloseIdleConnectionsFor(rc.Transport)\n\t\t}\n\t}\n\n\t// Slim and K8s clients use protobuf marshalling.\n\trc.ContentConfig.ContentType = `application/vnd.kubernetes.protobuf`\n\n\tclient.slim, err = slim_clientset.NewForConfigAndClient(rc, httpClient)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create slim k8s client: %w\", err)\n\t}\n\n\tclient.APIExtClientset, err = apiext_clientset.NewForConfigAndClient(rc, httpClient)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create apiext k8s client: %w\", err)\n\t}\n\n\tclient.MCSAPIClientset, err = mcsapi_clientset.NewForConfigAndClient(rc, httpClient)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create mcsapi k8s client: %w\", err)\n\t}\n\n\tclient.KubernetesClientset, err = kubernetes.NewForConfigAndClient(rc, httpClient)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create k8s client: %w\", err)\n\t}\n\n\tclient.PolicyClientset, err = policy_clientset.NewForConfigAndClient(rc, httpClient)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to create policy k8s client: %w\", err)\n\t}\n\n\tclient.ClientsetGetters = ClientsetGetters{&client}","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/k8s/client/cell.go#L167-L203","documentation":"The apiextensions clientset (used for CRD management) is created via apiext_clientset.NewForConfigAndClient. Failure means the clientset could not be built from the rest config and http client.","triggerScenarios":"apiext_clientset.NewForConfigAndClient(rc, httpClient) returns error during newClientsetForUserAgent — invalid rest config (bad host, TLS) surfacing at clientset construction time.","commonSituations":"Same root causes as other clientset failures: malformed kubeconfig host, TLS config problems, corrupted protobuf content-type settings.","solutions":["Inspect the wrapped error for the exact rest.Config field that is invalid","Validate rc.Host and TLS settings before client construction","Confirm kubeconfig validity with kubectl","Recreate the client after fixing the config rather than retrying with the same broken config"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"u, err := url.Parse(rc.Host)\nif err != nil || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid API server host: %q\", rc.Host)\n}","typeGuard":null,"tryCatchPattern":"apiext, err := apiext_clientset.NewForConfigAndClient(rc, httpClient)\nif err != nil {\n\tlog.Fatalf(\"apiext clientset init failed: %v\", err)\n}","preventionTips":["Validate rest.Config before constructing clientsets","Use a single shared validated rest.Config for all clientsets","Check wrapped root-cause errors rather than retrying","Keep kubeconfig valid and version-controlled"],"tags":["kubernetes","crd","clientset"],"backgroundTag":"invalid-k8s-client-config","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}