{"record":{"id":"ee619fd74eb9bb09","repo":"cilium/cilium","slug":"failed-to-collect-hubble-flows-w","errorCode":null,"errorMessage":"failed to collect hubble flows: %w","messagePattern":"failed to collect hubble flows: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/sysdump/sysdump.go","lineNumber":1590,"sourceCode":"\t\t\t\tfor _, pod := range c.CiliumPods {\n\t\t\t\t\tif pod.Status.Phase == corev1.PodRunning {\n\t\t\t\t\t\treturn c.submitKVStoreTasks(ctx, pod.DeepCopy())\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn fmt.Errorf(\"could not find running Cilium Pod\")\n\t\t\t},\n\t\t},\n\t}\n\tciliumTasks = append(ciliumTasks, collectCiliumV2OrV2Alpha1Resource(c, \"ciliumloadbalancerippools\", \"Cilium LoadBalancer IP Pools\"))\n\tciliumTasks = append(ciliumTasks, collectCiliumV2OrV2Alpha1Resource(c, \"ciliumpodippools\", \"Cilium Pod IP Pools\"))\n\tif c.Options.HubbleFlowsCount > 0 {\n\t\tciliumTasks = append(ciliumTasks, Task{\n\t\t\tCreatesSubtasks: true,\n\t\t\tDescription:     \"Collecting Hubble flows from Cilium pods\",\n\t\t\tQuick:           false,\n\t\t\tTask: func(ctx context.Context) error {\n\t\t\t\tif err := c.submitHubbleFlowsTasks(ctx, c.CiliumPods, ciliumAgentContainerName); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to collect hubble flows: %w\", err)\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t},\n\t\t})\n\t}\n\n\t// TODO(#2645): Ideally we would split ciliumTasks into\n\t// operator, agent, generic tasks, ..., etc\n\t// and only run then when feasible.\n\tif c.Options.CiliumNamespace != \"\" || c.Options.CiliumOperatorNamespace != \"\" {\n\t\ttasks = append(tasks, ciliumTasks...)\n\n\t\tserialTasks = append(serialTasks, Task{\n\t\t\tCreatesSubtasks: true,\n\t\t\tDescription:     \"Collecting profiling data from Cilium pods\",\n\t\t\tQuick:           false,\n\t\t\tTask: func(_ context.Context) error {\n\t\t\t\tif !c.Options.Profiling {","sourceCodeStart":1572,"sourceCodeEnd":1608,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/sysdump/sysdump.go#L1572-L1608","documentation":"The sysdump appends a task that calls c.submitHubbleFlowsTasks to gather Hubble flow logs (gops/observability output) from the Cilium agent containers in c.CiliumPods. Any failure inside that submission — pod exec setup, missing hubble container/config, or per-pod task errors — is wrapped with this prefix and returned to the Run loop. It means Hubble flow collection could not be scheduled or executed.","triggerScenarios":"c.Options.HubbleFlowsCount > 0 and c.submitHubbleFlowsTasks(ctx, c.CiliumPods, ciliumAgentContainerName) returns an error: typically pod exec failures against the agent container, no running Cilium pods, or Hubble not enabled in the cluster.","commonSituations":"Hubble not deployed/enabled while the user still requests --hubble-flows-count > 0; Cilium agent pods crashing so exec into ciliumAgentContainerName fails; RBAC/network restrictions blocking exec on agent pods; requesting flows from pods that were filtered out.","solutions":["Check that Hubble is enabled and running (kubectl -n <ns> get pods -l k8s-app=cilium, verify hubble is configured)","Retry the sysdump once agent pods are Running and exec-capable","Run with a lower/sane --hubble-flows-count or omit it if Hubble is not installed","Inspect the wrapped cause (%w) from the sysdump log for the underlying exec/list error"],"exampleFix":"// before: requesting flows in a cluster without Hubble\ncilium-cli sysdump --hubble-flows-count 100\n// after: enable Hubble first or drop the flag\ncilium-cli hubble enable && cilium-cli sysdump --hubble-flows-count 100","handlingStrategy":"try-catch","validationCode":"pods, _ := client.ListPods(ctx, ciliumNs, metav1.ListOptions{LabelSelector: \"k8s-app=cilium\"})\nif len(pods.Items) == 0 {\n    return errors.New(\"no Cilium pods; skip hubble flow collection\")\n}\nif _, err := client.ListPods(ctx, hubbleNs, metav1.ListOptions{LabelSelector: \"k8s-app=hubble-relay\"}); err != nil {\n    return errors.New(\"hubble not detected; run with --hubble-flows-count=0\")\n}","typeGuard":"func isHubbleFlowCollectionErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"failed to collect hubble flows\")\n}","tryCatchPattern":"err := sysdump.Run(ctx)\nvar target *tasks.TaskFailedError // or inspect message\nif err != nil && strings.Contains(err.Error(), \"failed to collect hubble flows\") {\n    log.Printf(\"hubble flow collection failed (is Hubble enabled?): %v\", err)\n    // degrade gracefully: continue without flows\n} else if err != nil {\n    return err\n}","preventionTips":["Enable Hubble (cilium-cli hubble enable) before requesting --hubble-flows-count > 0","Confirm agent pods accept exec before enabling flow collection","Test with a small flow count first to validate exec paths","Keep Cilium/Hubble versions aligned with the cilium-cli version"],"tags":["kubernetes","cilium","hubble","sysdump","pod-exec"],"backgroundTag":"kubernetes-pod-exec-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}