cilium/cilium · error

failed to get CiliumEndpoints by namespace index: %w

Error message

failed to get CiliumEndpoints by namespace index: %w

What it means

After obtaining the CiliumEndpoint store, Update lists CiliumEndpoints by the NamespaceIndex via cepStore.ByIndex(k8s.NamespaceIndex, namespace). This error wraps a failure of that indexed lookup, which normally only fails if the index is not registered or the store is in a bad state.

Source

Thrown at pkg/ztunnel/reconciler/reconciler.go:115

				case ops.endpointEventCh <- &xds.EndpointEvent{
					Type:           eventType,
					CiliumEndpoint: cep,
				}:
				case <-ctx.Done():
					return ctx.Err()
				}
			}
		}
		return nil
	}

	cepStore, err := ops.ciliumEndpointResource.Store(ctx)
	if err != nil {
		return fmt.Errorf("failed to get CiliumEndpoint store from K8sCiliumEndpointsWatcher: %w", err)
	}
	ceps, err := cepStore.ByIndex(k8s.NamespaceIndex, namespace)
	if err != nil {
		return fmt.Errorf("failed to get CiliumEndpoints by namespace index: %w", err)
	}
	for _, cep := range ceps {
		select {
		case ops.endpointEventCh <- &xds.EndpointEvent{
			Type:           eventType,
			CiliumEndpoint: cep,
		}:
		case <-ctx.Done():
			return ctx.Err()
		}
	}
	return nil
}

func (ops *EnrollmentReconciler) Update(ctx context.Context, txn statedb.ReadTxn, rev statedb.Revision, ns *table.EnrolledNamespace) error {
	if err := ops.emitEndpointEvents(ctx, ns.Name, xds.CREATE); err != nil {
		return err
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the CiliumEndpoint informer is created with k8s.NamespaceIndex added via AddIndexers
2. Inspect the wrapped error for 'index with name namespace does not exist' and fix informer setup
3. Restart/recreate the informer store so indexes are rebuilt
4. Confirm the store is a cache.Indexer, not a plain cache.Store

Example fix

// before
informer := cache.NewSharedIndexInformer(...) // no indexers
// after
cache.NewSharedIndexInformer(...)
inf.AddIndexers(cache.Indexers{k8s.NamespaceIndex: meta.NamespaceFunc})

// ensure the store is an Indexer with the namespace index before lookup
indexer, ok := cepStore.(cache.Indexer)
if !ok || indexer.IndexFuncs() == nil {
    return fmt.Errorf("cepStore lacks indexers")
}
// or: verify AddIndexers{k8s.NamespaceIndex: ...} was called on the informer

ceps, err := cepStore.ByIndex(k8s.NamespaceIndex, namespace)
if err != nil {
    if strings.Contains(err.Error(), "does not exist") {
        // rebuild informer with AddIndexers(k8s.NamespaceIndex)
        return restartInformerWithIndexers(ctx)
    }
    return fmt.Errorf("failed to get CiliumEndpoints by namespace index: %w", err)
}

When it happens

Trigger: Calling Update(namespace) when the cache's NamespaceIndex is missing/misconfigured on the CiliumEndpoint informer, or the store returned is not an Indexer with the expected index.

Common situations: Custom or refactored cache wiring that dropped the NamespaceIndex registration; using a plain store instead of the indexed informer store; version drift between istio/ztunnel and the k8s cache library.

Related errors

• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated
• unable to update some endpoints with new namespace labels
• no link found inside container
• failed to unmarshal bgp state from %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/7d466a2e45df2f4c. Report an issue: GitHub.