What causes "Error while creating k8s executor: %w" in cilium/cilium?

Inspect the wrapped error (%w) for the actual transport creation failure

Error while creating k8s executor: %w

Error message

Error while creating k8s executor: %w

What it means

This error wraps a failure from client-go's remotecommand.NewFallbackExecutor, which builds an executor that tries SPDY first and falls back to WebSocket for `kubectl exec`-style streaming into a pod. It is thrown when neither transport executor could be constructed — typically because the SPDY (and websocket) dialers could not be initialized from the client's REST config. The underlying cause is always available in the wrapped %w error.

Source

Thrown at cilium-cli/k8s/exec.go:59

	// not be nil if we want to avoid a crash. Therefore, if one of them
	// encountered an error, return the other one.
	if errSPDY != nil && errWebsocket == nil {
		return execWebsocket, nil
	}
	if errWebsocket != nil && errSPDY == nil {
		return execSPDY, nil
	}

	if errSPDY != nil && errWebsocket != nil {
		return nil, fmt.Errorf("Error while creating k8s executor: (websocket) %w, (spdy) %w", errWebsocket, errSPDY)
	}

	// Default to the SPDY connection
	execFallback, errFallback := remotecommand.NewFallbackExecutor(execSPDY, execWebsocket, func(err error) bool {
		return httpstream.IsUpgradeFailure(err) || httpstream.IsHTTPSProxyError(err)
	})
	if errFallback != nil {
		return nil, fmt.Errorf("Error while creating k8s executor: %w", errFallback)
	}

	return execFallback, nil
}

func (c *Client) execInPodWithWriters(connCtx, killCmdCtx context.Context, p ExecParameters, stdout, stderr io.Writer) error {
	req := c.Clientset.CoreV1().RESTClient().Post().Resource("pods").Name(p.Pod).Namespace(p.Namespace).SubResource("exec")

	scheme := runtime.NewScheme()
	if err := corev1.AddToScheme(scheme); err != nil {
		return fmt.Errorf("error adding to scheme: %w", err)
	}

	parameterCodec := runtime.NewParameterCodec(scheme)

	execOpts := &corev1.PodExecOptions{
		Command:   p.Command,
		Container: p.Container,

View on GitHub (pinned to ac7b90affa)

Solutions

Inspect the wrapped error (%w) for the actual transport creation failure
Verify the kubeconfig/RESTConfig used to build the k8s client is valid and reachable
Upgrade cilium-cli / client-go to a version with a working SPDY+WebSocket fallback
Check TLS settings and proxy environment variables (HTTPS_PROXY) that can break the exec transport

Example fix

// before (no error surfaced to user)
return nil, fmt.Errorf("Error while creating k8s executor: %w", errFallback)
// after (ensure config is validated earlier)
if c.RESTConfig == nil || c.RESTConfig.Host == "" {
	return nil, errors.New("k8s client has no valid REST config; check --context and kubeconfig")
}

Defensive patterns

Strategy: try-catch

Validate before calling

if client == nil || client.RESTConfig == nil || client.RESTConfig.Host == "" {
	return fmt.Errorf("k8s client not initialized: check --context and kubeconfig")
}

Type guard

func hasValidRestConfig(c *k8s.Client) bool {
	cfg := c.RESTConfig
	return cfg != nil && cfg.Host != ""
}

Try / catch

executor, err := newExecutor(...)
if err != nil {
	return fmt.Errorf("creating k8s executor (check kubeconfig/proxy/TLS): %w", err)
}

Prevention

Validate the kubeconfig and REST config before cluster operations
Test exec connectivity with a simple `kubectl exec` first
Audit HTTPS_PROXY/TLS env settings that can break upgraded connections
Keep client-go and cilium-cli versions aligned

When it happens

Trigger: Calling Client.ExecInPodWithWriters / execInPodWithWriters which invokes newExecutor; NewFallbackExecutor(execSPDY, execWebsocket, ...) returns an error, e.g. an invalid or nil RESTClient config, or an unsupported TLS/proxy configuration preventing transport creation.

Common situations: A Cilium CLI run against a cluster where the kubeconfig yields a broken or empty rest.Config; corporate HTTPS proxies breaking the upgrade transport; client-go version where websocket fallback dialer construction fails.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b13d48d79c2dc5d2. Report an issue: GitHub.