cilium/cilium · error

can't init service export store: %w

Error message

can't init service export store: %w

What it means

Same store-initialization pattern as the service store, but for the ServiceExports resource: serviceExportStore, err := s.serviceExports.Store(ctx) failing aborts the loop with this error.

Source

Thrown at clustermesh-apiserver/clustermesh/serviceexport_sync.go:152

		return nil
	}

	if s.clientset != nil /* clientset is nil in tests */ {
		err := client.CheckCRD(ctx, s.clientset, mcsapiv1beta1.SchemeGroupVersion.WithKind("serviceexports"))
		if err != nil {
			return fmt.Errorf("required ServiceExport CRD is not installed: %w", err)
		}
	}

	serviceEvents := s.services.Events(ctx)
	serviceStore, err := s.services.Store(ctx)
	if err != nil {
		return fmt.Errorf("can't init service store: %w", err)
	}
	serviceExportsEvents := s.serviceExports.Events(ctx)
	serviceExportStore, err := s.serviceExports.Store(ctx)
	if err != nil {
		return fmt.Errorf("can't init service export store: %w", err)
	}

	namespaceEvents := s.namespaces.Events(ctx)

	servicesSynced, serviceExportsSynced := false, false
	for serviceEvents != nil || serviceExportsEvents != nil || namespaceEvents != nil {
		select {
		case ev, ok := <-serviceEvents:
			if !ok {
				serviceEvents = nil
				continue
			}

			if ev.Kind == resource.Sync {
				servicesSynced = true
				if servicesSynced && serviceExportsSynced {
					s.store.Synced(ctx, s.syncCallback)
				}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Ensure ServiceExport CRD is installed and established (check CRD conditions).
2. Grant the apiserver's service account list/watch on serviceexports.
3. Read the wrapped root cause from logs and fix API server connectivity or permissions.

kubectl get crd serviceexports.multicluster.x-k8s.io -o jsonpath='{.status.conditions[?(@.type=="Established")].status}' # expect True
kubectl auth can-i list serviceexports.multicluster.x-k8s.io --as=system:serviceaccount:kube-system:clustermesh-apiserver

// Same retry-with-backoff pattern as store init; abort permanently only on NotFound/Forbidden
if errors.Is(err, context.Canceled) { return err }
retryWithBackoff(func() error { _, err = s.serviceExports.Store(ctx); return err })

When it happens

Trigger: Store(ctx) on the serviceExports resource fails, typically because the ServiceExports informer cannot list/watch (CRD missing, RBAC denied, API server error) or context is cancelled.

Common situations: MCS API CRDs partially installed (CRD exists but subresource/status not ready), RBAC limiting access to serviceexports, transient API server outage during startup.

Related errors

• Error listing Cilium Cluster Wide network policies: %w
• required ServiceExport CRD is not installed: %w
• unable to retrieve ConfigMap %q: %w
• get secret %q to retrieve CA: %w
• %s is not set in ConfigMap %q

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a55c64426b8d2be4. Report an issue: GitHub.