cilium/cilium · error

failed to collect GRPCRoute entries: %w

Error message

failed to collect GRPCRoute entries: %w

What it means

Returned by the 'Collecting GRPCRoute entries' sysdump task when the Client.ListUnstructured call for GRPCRoute (gateway.networking.k8s.io) fails. GRPCRoute is a relatively recent gateway-api addition, so the most common wrapped cause is that the CRD is not installed or the installed CRDs predate GRPCRoute (NoKindMatchError/NotFound).

Source

Thrown at cilium-cli/sysdump/sysdump.go:2224

				n := corev1.NamespaceAll
				v, err := c.Client.ListUnstructured(ctx, backendTLSPolicy, &n, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect BackendTLSPolicy entries: %w", err)
				}
				if err := c.WriteYAML(backendTLSPoliciesFileName, v); err != nil {
					return fmt.Errorf("failed to collect BackendTLSPolicy entries: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting GRPCRoute entries",
			Quick:       true,
			Task: func(ctx context.Context) error {
				n := corev1.NamespaceAll
				v, err := c.Client.ListUnstructured(ctx, grpcRoute, &n, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect GRPCRoute entries: %w", err)
				}
				if err := c.WriteYAML(grpcRoutesFileName, v); err != nil {
					return fmt.Errorf("failed to collect GRPCRoute entries: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting TCPRoute entries",
			Quick:       true,
			Task: func(ctx context.Context) error {
				n := corev1.NamespaceAll
				v, err := c.Client.ListUnstructured(ctx, tcpRoute, &n, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect TCPRoute entries: %w", err)
				}
				if err := c.WriteYAML(tcpRoutesFileName, v); err != nil {
					return fmt.Errorf("failed to collect TCPRoute entries: %w", err)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Upgrade the gateway-api CRDs to a release including GRPCRoute (standard-install.yaml for v1.1+)
2. Confirm with kubectl api-resources | grep grpcroutes
3. Fix RBAC: grant list on grpcroutes.gateway.networking.k8s.io
4. Re-run after checking cluster connectivity if the wrapped error is transient

Example fix

v, err := c.Client.ListUnstructured(ctx, grpcRoute, &n, metav1.ListOptions{})
if err != nil {
    if meta.IsNoMatchError(err) || apierrors.IsNotFound(err) {
        return nil // GRPCRoute CRD not installed; skip
    }
    return fmt.Errorf("failed to collect GRPCRoute entries: %w", err)
}

kubectl api-resources --api-group=gateway.networking.k8s.io | grep grpcroutes || echo "GRPCRoute missing - apply gateway-api v1.1+ CRDs"

func isMissingCRDErr(err error) bool {
    return apierrors.IsNotFound(err) || meta.IsNoMatchError(err) || apierrors.IsNotRegistered(err)
}

v, err := c.Client.ListUnstructured(ctx, grpcRoute, &n, metav1.ListOptions{})
if err != nil {
    if isMissingCRDErr(err) {
        return nil // GRPCRoute CRD not installed; skip
    }
    return fmt.Errorf("failed to collect GRPCRoute entries: %w", err)
}

When it happens

Trigger: Fires when c.Client.ListUnstructured(ctx, grpcRoute, &corev1.NamespaceAll, metav1.ListOptions{}) errors: grpcroutes.gateway.networking.k8s.io CRD missing/old version, RBAC denial on the list verb, or an API server request failure.

Common situations: Clusters with older gateway-api CRD bundles lacking GRPCRoute; partial CRD upgrades where some routes (HTTPRoute) exist but GRPCRoute does not; RBAC-restricted identities running cilium-cli sysdump.

Related errors

• failed to collect HTTPRoute entries: %w
• failed to collect BackendTLSPolicy entries: %w
• failed to collect UDPRoute entries: %w
• failed to collect TLSRoute entries: %w
• failed to collect TCPRoute entries: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/c14318d6bd15da7e. Report an issue: GitHub.