cilium/cilium · error

failed to collect the Cilium Envoy daemonset: %w

Error message

failed to collect the Cilium Envoy daemonset: %w

What it means

This error wraps an API error from GetDaemonSet for the cilium-envoy DaemonSet during a sysdump. NotFound is deliberately excluded (logged as a warning and skipped), so reaching this wrapper means the API call failed for a non-NotFound reason, or WriteYAML failed while persisting the fetched DaemonSet.

Source

Thrown at cilium-cli/sysdump/sysdump.go:1005

					return fmt.Errorf("failed to collect the Cilium Envoy configuration: %w", err)
				}
				if err := c.WriteYAML(ciliumEnvoyConfigMapFileName, v); err != nil {
					return fmt.Errorf("failed to collect the Cilium Envoy configuration: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting the Cilium Envoy daemonset",
			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.GetDaemonSet(ctx, c.Options.CiliumNamespace, ciliumEnvoyDaemonSetName, metav1.GetOptions{})
				if err != nil {
					if k8sErrors.IsNotFound(err) {
						c.logWarn("Daemonset %q not found in namespace %q - this is expected if Envoy DaemonSet is not enabled", ciliumEnvoyDaemonSetName, c.Options.CiliumNamespace)
						return nil
					}
					return fmt.Errorf("failed to collect the Cilium Envoy daemonset: %w", err)
				}
				if err := c.WriteYAML(ciliumEnvoyDaemonsetFileName, v); err != nil {
					return fmt.Errorf("failed to collect the Cilium Envoy daemonset: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting the Hubble daemonset",
			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.GetDaemonSet(ctx, c.Options.CiliumNamespace, hubbleDaemonSetName, metav1.GetOptions{})
				if err != nil {
					if k8sErrors.IsNotFound(err) {
						c.logDebug("Daemonset %q not found in namespace %q - this is expected in recent versions of Cilium", hubbleDaemonSetName, c.Options.CiliumNamespace)
						return nil
					}
					return fmt.Errorf("failed to collect the Hubble daemonset: %w", err)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check RBAC: kubectl auth can-i get daemonset -n <cilium-namespace>.
2. Verify cluster/API connectivity and the kubeconfig context used by cilium-cli.
3. Confirm the Cilium namespace is correct (--cilium-namespace).
4. Check disk space/permissions if WriteYAML is the failing step.

Example fix

// before
return fmt.Errorf("failed to collect the Cilium Envoy daemonset: %w", err)
// after
if apierrors.IsForbidden(err) {
    c.logWarn("No permission to read cilium-envoy DaemonSet: %v", err)
    return nil
}
return fmt.Errorf("failed to collect the Cilium Envoy daemonset: %w", err)

kubectl auth can-i get daemonset -n <cilium-namespace>
kubectl -n <cilium-namespace> get ds cilium-envoy

func isNotFoundErr(err error) bool { return k8sErrors.IsNotFound(err) }

if err := run(ctx); err != nil {
    if !k8sErrors.IsNotFound(errors.Unwrap(err)) {
        log.Printf("sysdump daemonset collection failed: %v", err)
    }
}

When it happens

Trigger: c.Client.GetDaemonSet(ctx, namespace, ciliumEnvoyDaemonSetName, metav1.GetOptions{}) fails with an error that is not k8sErrors.IsNotFound, or c.WriteYAML(ciliumEnvoyDaemonsetFileName, v) returns an error.

Common situations: API server connectivity drops mid-sysdump; RBAC forbids reading daemonsets in the Cilium namespace; wrong namespace configured; disk write failure when saving the YAML.

Related errors

• failed to list Cilium daemonsets: %w
• failed to collect the Hubble daemonset: %w
• unable to list socat server pods: %w
• unable to retrieve DaemonSet %s: %w
• timeout reached waiting for DaemonSet %s/%s to become ready

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/da1276cc95a25c07. Report an issue: GitHub.