cilium/cilium · error

failed to get logs from Hubble certgen pods

Error message

failed to get logs from Hubble certgen pods

What it means

The 'Collecting the Hubble certgen pod logs' task first lists pods matching HubbleGenerateCertsLabelSelector in the Cilium namespace. This error is returned when that ListPods call fails; note the message is slightly misleading — no logs were attempted yet, the pod listing itself failed. Unlike elsewhere, the underlying error is not wrapped, so the message alone hides the cause.

Source

Thrown at cilium-cli/sysdump/sysdump.go:1115

						return nil
					}
					return fmt.Errorf("failed to collect the Hubble generate certs cronjob: %w", err)
				}
				if err := c.WriteYAML(hubbleGenerateCertsCronJobFileName, v); err != nil {
					return fmt.Errorf("failed to collect the Hubble generate certs cronjob: %w", err)
				}
				return nil
			},
		},
		{
			Description: "Collecting the Hubble generate certs pod logs",
			Quick:       false,
			Task: func(ctx context.Context) error {
				p, err := c.Client.ListPods(ctx, c.Options.CiliumNamespace, metav1.ListOptions{
					LabelSelector: c.Options.HubbleGenerateCertsLabelSelector,
				})
				if err != nil {
					return fmt.Errorf("failed to get logs from Hubble certgen pods")
				}
				if err := c.SubmitLogsTasks(FilterPods(p, c.NodeList), c.Options.LogsSinceTime, c.Options.LogsLimitBytes); err != nil {
					return fmt.Errorf("failed to collect logs from Hubble certgen pods")
				}
				return nil
			},
		},
		{
			Description: "Collecting the Hubble cert-manager certificates",
			Quick:       true,
			Task: func(ctx context.Context) error {
				return c.GatherResourceUnstructured(
					ctx,
					certificate,
					hubbleCertificatesFileName,
					"hubble-relay-client-certs",
					"hubble-relay-server-certs",
					"hubble-server-certs",

View on GitHub (pinned to ac7b90affa)

Solutions

1. Run kubectl -n <CiliumNamespace> get pods -l <HubbleGenerateCertsLabelSelector> to reproduce outside cilium-cli.
2. Verify the namespace exists and the kubeconfig context is correct.
3. Check RBAC: kubectl auth can-i list pods -n <CiliumNamespace>.
4. If the certgen pods don't apply to your setup (no TLS cronjob method), treat this task's failure as non-blocking for the rest of the sysdump.

Example fix

// before
cilium-cli sysdump --namespace cilium   # pods list forbidden for current user
// after
kubectl auth can-i list pods -n cilium  # false -> bind the role
kubectl create rolebinding sysdump-pods --clusterrole=view --user=$USER -n cilium

kubectl get ns "$CILIUM_NS" >/dev/null || { echo "namespace missing"; exit 1; }
kubectl auth can-i list pods -n "$CILIUM_NS" || { echo "RBAC: cannot list pods"; exit 1; }
kubectl -n "$CILIUM_NS" get pods -l "$HUBBLE_CERTGEN_SELECTOR" -o name

if err := runSysdump(ctx, opts); err != nil {
	if strings.Contains(err.Error(), "failed to get logs from Hubble certgen pods") {
		// listing failed, not log collection; certgen logs are optional
		log.Printf("skipping certgen pod logs: %v", err)
		return nil
	}
	return err
}

When it happens

Trigger: c.Client.ListPods(ctx, c.Options.CiliumNamespace, metav1.ListOptions{LabelSelector: c.Options.HubbleGenerateCertsLabelSelector}) returns an error — namespace missing, RBAC forbids pods list, or API server unreachable. NotFound-style failures on list usually surface as other errors; here any list error triggers it.

Common situations: Typo in --namespace so the Cilium namespace doesn't exist; service account without pods/list permission; network policy or VPN blocking API server; expired kubeconfig credentials.

Related errors

• unable to list pods: %w
• unable to list Cilium pods: %w
• unable to list client pods: %w
• unable to list perf pods: %w
• failed to gather logs from %s:%s:%s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/992e832493e2f58d. Report an issue: GitHub.