What causes "failed to collect the Hubble UI deployment: %w" in cilium/cilium?

Check RBAC: kubectl auth can-i list deployments -n .

failed to collect the Hubble UI deployment: %w

Error message

failed to collect the Hubble UI deployment: %w

What it means

This error wraps an API error from ListDeployment for the Hubble UI deployment, selected by the Hubble UI label selector, during a sysdump. An empty result is warned and skipped; only a failing list API call reaches this wrapper.

Source

Thrown at cilium-cli/sysdump/sysdump.go:1075

					return nil
				}
				for i := range deployments.Items {
					if err := c.WriteYAML(hubbleRelayDeploymentFileName, &deployments.Items[i]); err != nil {
						return fmt.Errorf("failed to collect the Hubble Relay deployment %q: %w", deployments.Items[i].Name, err)
					}
				}
				return nil
			},
		},
		{
			Description: "Collecting the Hubble UI deployment",
			Quick:       true,
			Task: func(ctx context.Context) error {
				deployments, err := c.Client.ListDeployment(ctx, c.Options.CiliumNamespace, metav1.ListOptions{
					LabelSelector: c.Options.HubbleUILabelSelector,
				})
				if err != nil {
					return fmt.Errorf("failed to collect the Hubble UI deployment: %w", err)
				}
				if len(deployments.Items) == 0 {
					c.logWarn("Deployment with label %q not found in namespace %q - this is expected if Hubble UI is not enabled", c.Options.HubbleUILabelSelector, c.Options.CiliumNamespace)
					return nil
				}
				for i := range deployments.Items {
					if err := c.WriteYAML(hubbleUIDeploymentFileName, &deployments.Items[i]); err != nil {
						return fmt.Errorf("failed to collect the Hubble UI deployment %q: %w", deployments.Items[i].Name, err)
					}
				}
				return nil
			},
		},
		{
			Description: "Collecting the Hubble generate certs cronjob",
			Quick:       true,
			Task: func(ctx context.Context) error {
				v, err := c.Client.GetCronJob(ctx, c.Options.CiliumNamespace, hubbleGenerateCertsCronJob, metav1.GetOptions{})

View on GitHub (pinned to ac7b90affa)

Solutions

Check RBAC: kubectl auth can-i list deployments -n <cilium-namespace>.
Validate the Hubble UI label selector: kubectl get deployments -l '<selector>' -n <ns>.
Verify cluster connectivity and kubeconfig context.
Retry on transient API errors.

Example fix

// before
return fmt.Errorf("failed to collect the Hubble UI deployment: %w", err)
// after
if apierrors.IsForbidden(err) {
    c.logWarn("No permission to list Hubble UI deployments: %v", err)
    return nil
}
return fmt.Errorf("failed to collect the Hubble UI deployment: %w", err)

Defensive patterns

Strategy: try-catch

Validate before calling

kubectl auth can-i list deployments -n <cilium-namespace>
kubectl get deployments -l '<hubble-ui-label-selector>' -n <cilium-namespace>

Type guard

func isForbiddenErr(err error) bool { return apierrors.IsForbidden(err) }

Try / catch

if err := task(ctx); err != nil {
    if apierrors.IsForbidden(errors.Unwrap(err)) {
        log.Println("RBAC denies listing Hubble UI deployments; skipping")
        return nil
    }
    return err
}

Prevention

Grant deployments list RBAC before running sysdump.
Validate HubbleUILabelSelector syntax (a malformed selector yields HTTP 400).
Confirm Hubble UI is installed if its deployment is expected in the dump.
Verify kubeconfig context and API server health.

When it happens

Trigger: c.Client.ListDeployment(ctx, namespace, metav1.ListOptions{LabelSelector: c.Options.HubbleUILabelSelector}) returns a non-nil error inside the 'Collecting the Hubble UI deployment' task.

Common situations: RBAC denies deployment list; API server unreachable or timing out; invalid label selector (HTTP 400); wrong cluster/namespace.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/bbf823cd7fe40249. Report an issue: GitHub.