failed to collect identity entries from Cilium SPIRE server

Error message

failed to collect identity entries from Cilium SPIRE server pods

What it means

Thrown when the SPIRE server pods were listed successfully but c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)) fails. This helper submits per-pod subtasks that exec into SPIRE server pods and fetch identity entries; a failure means those subtasks could not be created or the entry collection failed. The underlying error is not wrapped, so the specific cause is hidden.

Source

Thrown at cilium-cli/sysdump/sysdump.go:2102

				if err := c.WriteYAML(ciliumSPIREServerConfigMapFileName, v); err != nil {
					return fmt.Errorf("failed to collect the Cilium SPIRE server configuration: %w", err)
				}
				return nil
			},
		},
		{
			CreatesSubtasks: true,
			Description:     "Collecting the Cilium SPIRE server identity entries",
			Quick:           false,
			Task: func(ctx context.Context) error {
				p, err := c.Client.ListPods(ctx, c.Options.CiliumSPIRENamespace, metav1.ListOptions{
					LabelSelector: c.Options.CiliumSPIREServerLabelSelector,
				})
				if err != nil {
					return fmt.Errorf("failed to get identity entries from Cilium SPIRE server pods")
				}
				if err := c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)); err != nil {
					return fmt.Errorf("failed to collect identity entries from Cilium SPIRE server pods")
				}
				return nil
			},
		},
	}
}

func (c *Collector) getGatewayAPITasks() []Task {
	return []Task{
		{
			Description: "Collecting GatewayClass entries",
			Quick:       true,
			Task: func(ctx context.Context) error {
				n := corev1.NamespaceAll
				v, err := c.Client.ListUnstructured(ctx, gatewayClass, &n, metav1.ListOptions{})
				if err != nil {
					return fmt.Errorf("failed to collect GatewayClass entries: %w", err)
				}

View on GitHub (pinned to ac7b90affa)

Solutions

Check SPIRE server pod status: kubectl get pods -n <ns> -l <CiliumSPIREServerLabelSelector> and confirm it is Running.
Verify the label selector in --cilium-spire-server-label-selector matches the actual pod labels.
Check exec permission: kubectl auth can-i create pods/exec -n <ns>.
Rerun the sysdump once the SPIRE server pod is healthy.

Example fix

// before
return fmt.Errorf("failed to collect identity entries from Cilium SPIRE server pods")
// after
return fmt.Errorf("failed to collect identity entries from Cilium SPIRE server pods: %w", err)

Defensive patterns

Strategy: try-catch

Validate before calling

kubectl get pods -n "$CILIUM_SPIRE_NAMESPACE" -l "$SPIRE_SERVER_LABEL_SELECTOR" -o jsonpath='{.items[*].status.phase}'  # expect Running
kubectl auth can-i create pods/exec -n "$CILIUM_SPIRE_NAMESPACE"

Try / catch

if err := c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)); err != nil {
    return fmt.Errorf("failed to collect identity entries from Cilium SPIRE server pods: %w", err)
}
// catch: check for zero matched pods or exec/RBAC errors in the cause

Prevention

Ensure the SPIRE server pod is Running before collecting.
Confirm the server label selector matches deployed pod labels.
Grant pods/exec create permission cluster-wide.
Wrap the underlying error so diagnostics are preserved.

When it happens

Trigger: c.submitSpireEntriesTasks(FilterPods(p, c.NodeList)) returns an error: no matching SPIRE server pods after filtering against the node list, exec into the pod failing (container not running, missing exec permission), or subtask submission failing.

Common situations: SPIRE server pod in CrashLoopBackOff or not Running; label selector not matching the actual pods; pod scheduled on nodes not present in the collected NodeList so FilterPods drops them; exec RBAC (pods/exec create) denied.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/164e13cae45e630a. Report an issue: GitHub.