cilium/cilium · error

failed to collect %s (%s): %w

Error message

failed to collect %s (%s): %w

What it means

GatherResourceUnstructured fails when ListUnstructured errors while listing the given GroupVersionResource across namespaces. The resource name and version are included in the message.

Source

Thrown at cilium-cli/sysdump/sysdump.go:362

		}
		c.CiliumOperatorPods = AllPods(pods)
	}

	if err := hooks.AddSysdumpTasks(c); err != nil {
		return nil, fmt.Errorf("failed to add custom sysdump tasks: %w", err)
	}

	return c, nil
}

// GatherResourceUnstructured queries resources with the given GroupVersionResource, storing them in the file specified by fname.
// If keep is non-empty; then it will filter the items returned, keeping only those with names listed in keep.
// If keep is empty, it will not filter the resources returned.
func (c *Collector) GatherResourceUnstructured(ctx context.Context, r schema.GroupVersionResource, fname string, keep ...string) error {
	n := corev1.NamespaceAll
	v, err := c.Client.ListUnstructured(ctx, r, &n, metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("failed to collect %s (%s): %w", r.Resource, r.Version, err)
	}

	filtered := &unstructured.UnstructuredList{
		Object: v.Object,
	}
	// keep everything if keep is empty
	if len(keep) == 0 {
		filtered.Items = v.Items
	} else {
		// only save the resources which are specified by keep
		for _, elem := range v.Items {
			for _, name := range keep {
				if name == elem.GetName() {
					filtered.Items = append(filtered.Items, elem)
				}
			}
		}
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the CRD/resource exists: kubectl api-resources | grep <resource>
2. Grant RBAC list permission on the resource group
3. Align cilium-cli version with the installed Cilium version
4. Install missing CRDs if the resource is genuinely required

Example fix

// before
cilium-cli sysdump  # assumes ciliumnodes CRD exists
// after
kubectl api-resources | grep ciliumnodes || kubectl apply -f cilium-crds.yaml
cilium-cli sysdump

// check resource availability before gathering
res, err := discoveryClient.ServerResourcesForGroupVersion(r.Group + "/" + r.Version)
if err != nil || !hasResource(res, r.Resource) {
    return fmt.Errorf("resource %s not served by cluster", r.Resource)
}

null

err := collector.GatherResourceUnstructured(ctx, gvr, fname)
if err != nil {
    var agg interface{ Unwrap() error }
    if errors.As(err, &target) && k8serrors.IsNotFound(target) {
        log.Printf("skipping missing resource %s", gvr.Resource)
        return nil
    }
    return err
}

When it happens

Trigger: Listing a non-namespaced/all-namespace resource where the client lacks RBAC list permission, the GVR doesn't exist on the server (older cluster without the CRD), or the API group/version is wrong.

Common situations: Collecting cilium CRDs on a cluster where the CRD isn't installed, RBAC-restricted environments, version mismatch between cilium-cli expected resources and installed Cilium version.

Related errors

• unable to retrieve CRD %s: %w
• unable to retrieve CiliumLocalRedirectPolicy %s: %w
• failed to collect Cilium cluster-wide network policies: %w
• failed to collect Cilium L2 announcement policies: %w
• failed to delete CiliumCIDRGroup %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/112258afca9b462f. Report an issue: GitHub.