cilium/cilium · error

failed to check for Cilium DaemonSet: %w

Error message

failed to check for Cilium DaemonSet: %w

What it means

While detecting the Cilium namespace, after confirming the namespace exists cilium-cli checks for the 'cilium' DaemonSet via GetDaemonSet. A non-NotFound error from that call aborts detection with this wrapped error. It signals an API failure while verifying the Cilium installation, distinct from 'not found' (which just continues to the next namespace).

Source

Thrown at cilium-cli/sysdump/sysdump.go:3448

}

func detectCiliumNamespace(k KubernetesClient) (string, error) {
	for _, ns := range DefaultCiliumNamespaces {
		ctx := context.Background()
		ns, err := k.GetNamespace(ctx, ns, metav1.GetOptions{})
		if k8sErrors.IsNotFound(err) {
			continue
		}
		if err != nil {
			return "", fmt.Errorf("failed to detect Cilium namespace: %w", err)
		}

		_, err = k.GetDaemonSet(ctx, ns.Name, "cilium", metav1.GetOptions{})
		if k8sErrors.IsNotFound(err) {
			continue
		}
		if err != nil {
			return "", fmt.Errorf("failed to check for Cilium DaemonSet: %w", err)
		}
		return ns.Name, nil
	}
	return "", fmt.Errorf("failed to detect Cilium namespace, could not find Cilium installation in namespaces: %v", DefaultCiliumNamespaces)
}

func detectCiliumOperatorNamespace(k KubernetesClient) (string, error) {
	for _, ns := range DefaultCiliumNamespaces {
		ctx := context.Background()
		ns, err := k.GetNamespace(ctx, ns, metav1.GetOptions{})
		if k8sErrors.IsNotFound(err) {
			continue
		}
		if err != nil {
			return "", fmt.Errorf("failed to detect Cilium operator namespace: %w", err)
		}

		_, err = k.GetDeployment(ctx, ns.Name, ciliumOperatorDeploymentName, metav1.GetOptions{})

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check RBAC: kubectl auth can-i get daemonsets -n NAMESPACE
2. Verify API server health: kubectl get ds -n NAMESPACE cilium directly
3. If Cilium is genuinely absent (missing CRDs/operator), install it or pass the namespace explicitly
4. Retry once the control plane recovers

Example fix

// before
_, err = k.GetDaemonSet(ctx, ns.Name, "cilium", metav1.GetOptions{})
// after: log and continue scanning remaining namespaces
_, err = k.GetDaemonSet(ctx, ns.Name, "cilium", metav1.GetOptions{})
if err != nil && !k8sErrors.IsNotFound(err) {
    log.Printf("skipping ns %s: %v", ns.Name, err)
    continue
}

ok, err := authCanI("get", "daemonsets", ns)
if err != nil || !ok { return fmt.Errorf("RBAC: cannot get daemonsets in %s", ns) }

func isRBACDenied(err error) bool {
    var ae *apierrors.StatusError
    return errors.As(err, &ae) && ae.Status().Reason == metav1.StatusReasonForbidden
}

_, err := k.GetDaemonSet(ctx, ns.Name, "cilium", metav1.GetOptions{})
switch {
case apierrors.IsNotFound(err):
    continue // next candidate namespace
case isRBACDenied(err):
    return fmt.Errorf("grant daemonset get RBAC in %s: %w", ns.Name, err)
case err != nil:
    return fmt.Errorf("api error checking cilium daemonset: %w", err)
}

When it happens

Trigger: detectCiliumNamespace: GetNamespace succeeded for a candidate namespace, then k.GetDaemonSet(ns, "cilium") returns a non-NotFound error such as Forbidden, Timeout, or InternalError.

Common situations: RBAC allows namespace get but not daemonset get; API server degraded; etcd quorum loss causing internal errors; network interruption mid-detection.

Related errors

• unable to retrieve DaemonSet %s: %w
• failed to list Cilium daemonsets: %w
• unable to determine status of Cilium DaemonSet: %w
• unable to list echo external services: %w
• unable to list socat server pods: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b8112e98a07e0f94. Report an issue: GitHub.