{"record":{"id":"f90bdd2bcf4a379c","repo":"cilium/cilium","slug":"unable-to-list-lrp-pods-w","errorCode":null,"errorMessage":"unable to list lrp pods: %w","messagePattern":"unable to list lrp pods: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/connectivity/check/deployment.go","lineNumber":2916,"sourceCode":"\t\treturn ct.perfServerPod[i].Pod.Name < ct.perfServerPod[j].Pod.Name\n\t})\n\tsort.SliceStable(ct.perfClientPods, func(i, j int) bool {\n\t\treturn ct.perfClientPods[i].Pod.Name < ct.perfClientPods[j].Pod.Name\n\t})\n\n\treturn nil\n}\n\nfunc (ct *ConnectivityTest) validateDeployment(ctx context.Context) error {\n\tsrcDeployments, dstDeployments := ct.deploymentList()\n\tif err := ct.validateDeploymentCommon(ctx, srcDeployments, dstDeployments); err != nil {\n\t\treturn err\n\t}\n\n\tif ct.Features[features.LocalRedirectPolicy].Enabled {\n\t\tlrpPods, err := ct.client.ListPods(ctx, ct.params.TestNamespace, metav1.ListOptions{LabelSelector: \"kind=\" + kindLrpName})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to list lrp pods: %w\", err)\n\t\t}\n\t\tfor _, lrpPod := range lrpPods.Items {\n\t\t\tif v, hasLabel := lrpPod.GetLabels()[\"lrp\"]; hasLabel {\n\t\t\t\tif v == \"backend\" {\n\t\t\t\t\tct.lrpBackendPods[lrpPod.Name] = Pod{\n\t\t\t\t\t\tK8sClient: ct.client,\n\t\t\t\t\t\tPod:       lrpPod.DeepCopy(),\n\t\t\t\t\t}\n\t\t\t\t} else if v == \"client\" {\n\t\t\t\t\tct.lrpClientPods[lrpPod.Name] = Pod{\n\t\t\t\t\t\tK8sClient: ct.client,\n\t\t\t\t\t\tPod:       lrpPod.DeepCopy(),\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n","sourceCodeStart":2898,"sourceCodeEnd":2934,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/connectivity/check/deployment.go#L2898-L2934","documentation":"When the LocalRedirectPolicy feature is enabled, the test lists lrp pods by the kind=<lrpName> label after deployment to register backend/direct-response pods. This error wraps the ListPods failure with %w, retaining the API cause. The LRP portion of validation is skipped on failure since the pods can't be tracked.","triggerScenarios":"ct.client.ListPods(ctx, TestNamespace, metav1.ListOptions{LabelSelector: \"kind=\" + kindLrpName}) returns non-nil: RBAC forbidden, namespace gone, or API server error. Only occurs when ct.Features[features.LocalRedirectPolicy].Enabled.","commonSituations":"Restricted RBAC profiles blocking pod list in the test namespace; namespace removed by a concurrent cleanup; temporary API server unavailability during a long test run.","solutions":["Inspect the wrapped cause and run kubectl -n <TestNamespace> get pods -l kind=<lrpName> manually","Grant pods list permission: kubectl auth can-i list pods -n <TestNamespace>, add rolebinding if no","Recreate the test namespace if it was deleted: cilium-cli connectivity test will recreate it on next run","Retry; if the feature isn't needed, this path only runs with LocalRedirectPolicy enabled"],"exampleFix":"// before\nError: unable to list lrp pods: namespaces \"cilium-test\" not found\n// after\nkubectl create namespace cilium-test\n# or simply re-run the test which recreates the namespace","handlingStrategy":"retry","validationCode":"kubectl auth can-i list pods -n <TestNamespace>\nkubectl get ns <TestNamespace>\n# feature gate: only needed when LocalRedirectPolicy is enabled\nkubectl -n kube-system exec ds/cilium -- cilium-dbg status | grep -i lrp","typeGuard":null,"tryCatchPattern":"lrpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: \"kind=\" + kindLrpName})\nif err != nil {\n    if apierrors.IsForbidden(err) {\n        return fmt.Errorf(\"cannot list LRP pods (check RBAC): %w\", err)\n    }\n    // transient: retry with backoff before failing the run\n    return retryBeforeFail(ctx, 3, 2*time.Second, func() error { return listLrpPods(ctx) })\n}","preventionTips":["Verify LRP feature support before enabling it in test flags","Keep test namespace lifecycle within a single cilium-cli invocation","Confirm pods list permission for all cluster contexts used (src and dst)"],"tags":["kubernetes","cilium-cli","lrp","pods"],"backgroundTag":"kubernetes-pod-list-forbidden","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}