{"record":{"id":"da1276cc95a25c07","repo":"cilium/cilium","slug":"failed-to-collect-the-cilium-envoy-daemonset-w","errorCode":null,"errorMessage":"failed to collect the Cilium Envoy daemonset: %w","messagePattern":"failed to collect the Cilium Envoy daemonset: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":1005,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Cilium Envoy configuration: %w\", err)\n\t\t\t\t}\n\t\t\t\tif err := c.WriteYAML(ciliumEnvoyConfigMapFileName, v); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Cilium Envoy configuration: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Cilium Envoy daemonset\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tv, err := c.Client.GetDaemonSet(ctx, c.Options.CiliumNamespace, ciliumEnvoyDaemonSetName, metav1.GetOptions{})\n\t\t\t\tif err != nil {\n\t\t\t\t\tif k8sErrors.IsNotFound(err) {\n\t\t\t\t\t\tc.logWarn(\"Daemonset %q not found in namespace %q - this is expected if Envoy DaemonSet is not enabled\", ciliumEnvoyDaemonSetName, c.Options.CiliumNamespace)\n\t\t\t\t\t\treturn nil\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Cilium Envoy daemonset: %w\", err)\n\t\t\t\t}\n\t\t\t\tif err := c.WriteYAML(ciliumEnvoyDaemonsetFileName, v); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Cilium Envoy daemonset: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tDescription: \"Collecting the Hubble daemonset\",\n\t\t\tQuick:       true,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tv, err := c.Client.GetDaemonSet(ctx, c.Options.CiliumNamespace, hubbleDaemonSetName, metav1.GetOptions{})\n\t\t\t\tif err != nil {\n\t\t\t\t\tif k8sErrors.IsNotFound(err) {\n\t\t\t\t\t\tc.logDebug(\"Daemonset %q not found in namespace %q - this is expected in recent versions of Cilium\", hubbleDaemonSetName, c.Options.CiliumNamespace)\n\t\t\t\t\t\treturn nil\n\t\t\t\t\t}\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect the Hubble daemonset: %w\", err)","sourceCodeStart":987,"sourceCodeEnd":1023,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L987-L1023","documentation":"This error wraps an API error from GetDaemonSet for the cilium-envoy DaemonSet during a sysdump. NotFound is deliberately excluded (logged as a warning and skipped), so reaching this wrapper means the API call failed for a non-NotFound reason, or WriteYAML failed while persisting the fetched DaemonSet.","triggerScenarios":"c.Client.GetDaemonSet(ctx, namespace, ciliumEnvoyDaemonSetName, metav1.GetOptions{}) fails with an error that is not k8sErrors.IsNotFound, or c.WriteYAML(ciliumEnvoyDaemonsetFileName, v) returns an error.","commonSituations":"API server connectivity drops mid-sysdump; RBAC forbids reading daemonsets in the Cilium namespace; wrong namespace configured; disk write failure when saving the YAML.","solutions":["Check RBAC: kubectl auth can-i get daemonset -n <cilium-namespace>.","Verify cluster/API connectivity and the kubeconfig context used by cilium-cli.","Confirm the Cilium namespace is correct (--cilium-namespace).","Check disk space/permissions if WriteYAML is the failing step."],"exampleFix":"// before\nreturn fmt.Errorf(\"failed to collect the Cilium Envoy daemonset: %w\", err)\n// after\nif apierrors.IsForbidden(err) {\n    c.logWarn(\"No permission to read cilium-envoy DaemonSet: %v\", err)\n    return nil\n}\nreturn fmt.Errorf(\"failed to collect the Cilium Envoy daemonset: %w\", err)","handlingStrategy":"try-catch","validationCode":"kubectl auth can-i get daemonset -n <cilium-namespace>\nkubectl -n <cilium-namespace> get ds cilium-envoy","typeGuard":"func isNotFoundErr(err error) bool { return k8sErrors.IsNotFound(err) }","tryCatchPattern":"if err := run(ctx); err != nil {\n    if !k8sErrors.IsNotFound(errors.Unwrap(err)) {\n        log.Printf(\"sysdump daemonset collection failed: %v\", err)\n    }\n}","preventionTips":["Verify RBAC for daemonset reads before running sysdump.","Confirm cilium-envoy DaemonSet exists (requires Cilium >= 1.11 with Envoy DaemonSet enabled).","Use a service account/kubeconfig with cluster-wide read access for diagnostics."],"tags":["kubernetes","cilium","sysdump","daemonset"],"backgroundTag":"kubernetes-rbac-forbidden","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}