{"record":{"id":"eaeae47286c9f446","repo":"cilium/cilium","slug":"unable-to-list-cilium-pods-w","errorCode":null,"errorMessage":"unable to list Cilium pods: %w","messagePattern":"unable to list Cilium pods: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/bgp/bgp.go","lineNumber":55,"sourceCode":"func NewStatus(client *k8s.Client, p Parameters) *Status {\n\treturn &Status{\n\t\tclient: client,\n\t\tparams: p,\n\t}\n}\n\n// initTargetCiliumPods stores cilium agent pods in the status.ciliumPods.\n// If node selector option is specified then only that nodes' cilium-agent\n// pod is stored else all cilium-agents in the cluster are stored.\nfunc (s *Status) initTargetCiliumPods(ctx context.Context) error {\n\topts := metav1.ListOptions{LabelSelector: s.params.AgentPodSelector}\n\tif s.params.NodeName != \"\" {\n\t\topts.FieldSelector = fmt.Sprintf(\"spec.nodeName=%s\", s.params.NodeName)\n\t}\n\n\tciliumPods, err := s.client.ListPods(ctx, s.params.CiliumNamespace, opts)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to list Cilium pods: %w\", err)\n\t}\n\n\tfor _, ciliumPod := range ciliumPods.Items {\n\t\ts.ciliumPods = append(s.ciliumPods, ciliumPod.DeepCopy())\n\t}\n\treturn nil\n}\n","sourceCodeStart":37,"sourceCodeEnd":63,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/bgp/bgp.go#L37-L63","documentation":"initTargetCiliumPods in cilium-cli/bgp/bgp.go lists Cilium agent pods via s.client.ListPods in the Cilium namespace, optionally filtered by spec.FieldName for NodeName. If the Kubernetes API list call fails it wraps the cause as \"unable to list Cilium pods: %w\". GetPeeringState and GetRoutes both depend on this, so BGP status commands fail at the first step.","triggerScenarios":"Calling GetPeeringState/GetRoutes when the API server is unreachable, the kubeconfig context is wrong, RBAC forbids listing pods in the Cilium namespace, or the Cilium namespace name does not match the cluster's actual namespace.","commonSituations":"cilium-cli pointed at the wrong cluster/context; custom cilium namespace (e.g. kube-system vs cilium) not passed via --namespace; expired/stale kubeconfig credentials; network policy or RBAC blocking pod list in a restricted cluster.","solutions":["Verify kubeconfig connectivity: kubectl get pods -n <cilium-ns> must succeed with the same credentials","Pass the correct --namespace flag for the Cilium installation namespace","Check RBAC allows list/get pods in that namespace for your user/serviceaccount","If using --node-name filter, confirm the node name matches spec.nodeName exactly"],"exampleFix":"// before\ncilium bgp peers  # assumes default 'kube-system'\n// after\ncilium bgp peers --namespace cilium","handlingStrategy":"validation","validationCode":"pods, err := clientset.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{})\nif err != nil {\n    return fmt.Errorf(\"kubeconfig/RBAC check failed: %w\", err)\n}","typeGuard":"func isListErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"unable to list Cilium pods\")\n}","tryCatchPattern":"if err := status.GetPeeringState(ctx); err != nil {\n    if isListErr(err) {\n        // fix kubeconfig context / namespace / RBAC, then retry\n    }\n    return err\n}","preventionTips":["Validate kubectl connectivity to the cluster before cilium-cli commands","Always pass the correct --namespace for the Cilium installation","Grant ClusterRole permissions to list pods in the Cilium namespace","Sanity-check --node-name against kubectl get nodes"],"tags":["go","kubernetes","cilium-cli","rbac","api-server"],"backgroundTag":"kubernetes-api-list-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}