What causes "failed to collect Cilium endpoint slices: %w" in cilium/cilium?

Check kubectl get ciliumendpointslices -A to surface the true error

failed to collect Cilium endpoint slices: %w

Error message

failed to collect Cilium endpoint slices: %w

What it means

Returned by the 'Collecting Cilium endpoint slices' task in Run() when ListCiliumEndpointSlices(ctx, metav1.ListOptions{}) fails; the underlying error is preserved via %w. It indicates CiliumEndpointSlice resources could not be retrieved (or, in the second branch, written) during sysdump collection.

Source

Thrown at cilium-cli/sysdump/sysdump.go:823

			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.ListCiliumEndpoints(ctx, corev1.NamespaceAll, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect Cilium endpoints: %w", err)
				}
				if err := c.WriteYAML(ciliumEndpointsFileName, v); err != nil {
					return fmt.Errorf("failed to collect Cilium endpoints: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting Cilium endpoint slices",
			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.ListCiliumEndpointSlices(ctx, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect Cilium endpoint slices: %w", err)
				}
				if err := c.WriteYAML(ciliumEndpointSlicesFileName, v); err != nil {
					return fmt.Errorf("failed to collect Cilium endpoint slices: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting Cilium identities",
			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.ListCiliumIdentities(ctx)
				if err != nil {
					return fmt.Errorf("failed to collect Cilium identities: %w", err)
				}
				if err := c.WriteYAML(ciliumIdentitiesFileName, v); err != nil {
					return fmt.Errorf("failed to collect Cilium identities: %w", err)
				}

View on GitHub (pinned to ac7b90affa)

Solutions

Check kubectl get ciliumendpointslices -A to surface the true error
Upgrade Cilium and/or enable ciliumEndpointSlice (helm set ciliumEndpointSlice.enabled=true)
Add ciliumendpointslices.cilium.io to RBAC list/get rules
If the wrapped error is from WriteYAML, fix output permissions/disk space

Example fix

# before
cilium install --set ciliumEndpointSlice.enabled=false
# after
cilium install --set ciliumEndpointSlice.enabled=true
kubectl get crd ciliumendpointslices.cilium.io

Defensive patterns

Strategy: try-catch

Validate before calling

import "sigs.k8s.io/controller-runtime/pkg/client"
func canListEndpointSlices(ctx context.Context, c client.Client) error {
	return c.List(ctx, &ciliumv2.CiliumEndpointSliceList{}) // early CRD/RBAC probe
}

Type guard

func isListError(err error) bool { return apierrors.IsNotFound(err) || apierrors.IsForbidden(err) || apierrors.IsTimeout(err) }

Try / catch

if err := collect(); err != nil {
	if apierrors.IsNotFound(err) {
		log.Warn("ciliumendpointslices CRD missing; feature disabled or old Cilium — skipping")
	} else if apierrors.IsForbidden(err) {
		log.Warn("RBAC: add ciliumendpointslices to rules")
	} else {
		return fmt.Errorf("failed to collect Cilium endpoint slices: %w", err)
	}
}

Prevention

Enable ciliumEndpointSlice.enabled=true on Cilium installs that expect it
Keep RBAC manifests in sync with every new cilium.io CRD after upgrades
Smoke-test each resource type with kubectl get before sysdump
Handle optional CRDs as skippable rather than fatal in wrappers

When it happens

Trigger: ListCiliumEndpointSlices errors: ciliumendpointslices.cilium.io CRD not installed (feature off / old Cilium), RBAC denial, API server unreachable, or the WriteYAML branch for ciliumEndpointSlicesFileName fails with the same message.

Common situations: Cilium deployments without EndpointSlice mode enabled (ciliumEndpointSlice.enabled=false), clusters upgraded from older Cilium lacking the CRD, RBAC policies that enumerate allowed cilium.io resources but omit this new one.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a0aa3f30aa0c53ea. Report an issue: GitHub.