cilium/cilium · error

failed to get namespace store: %w

Error message

failed to get namespace store: %w

What it means

At cell startup the namespace manager obtains a named-resource store of Kubernetes namespaces; if Namespaces.Store(ctx) fails, the hook aborts startup with this wrapped error. The underlying cause (ctx err) is chained via %w.

Source

Thrown at pkg/clustermesh/namespace/namespace.go:49

}

type manager struct {
	logger *slog.Logger
	cfg    Config
	store  resource.Store[*slim_corev1.Namespace]
}

func newManager(params managerParams) *manager {
	m := &manager{
		logger: params.Logger,
		cfg:    params.Config,
	}

	params.Lifecycle.Append(cell.Hook{
		OnStart: func(ctx cell.HookContext) error {
			store, err := params.Namespaces.Store(ctx)
			if err != nil {
				return fmt.Errorf("failed to get namespace store: %w", err)
			}
			m.store = store
			return nil
		},
	})

	return m
}

// IsGlobalNamespaceByObject determines whether the given namespace should be treated as a global
// namespace based on its annotations and the provided configuration.
func (m *manager) IsGlobalNamespaceByObject(ns *slim_corev1.Namespace) bool {
	if ns == nil {
		return false
	}
	// Get annotations for the namespace.
	// If annotated with "clustermesh.cilium.io/global", supercede the default config.
	annotations := ns.GetAnnotations()

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check k8s API server connectivity and kubeconfig from the agent pod
2. Verify RBAC allows list/watch on namespaces (clustermesh namespace Role/ClusterRole)
3. Inspect the wrapped cause in logs for the root error
4. Restart the agent once the API server is reachable

Example fix

# before: missing RBAC
# after: grant access
kind: ClusterRole
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["list", "watch"]

if err := k8sClient.Discovery().ServerVersion(); err != nil {
    return fmt.Errorf("k8s API unreachable before start: %w", err)
}

// hive retries via lifecycle; wrap startup
if err := start(); err != nil {
    if strings.Contains(err.Error(), "failed to get namespace store") {
        return retryWithBackoff(start)
    }
    return err
}

When it happens

Trigger: Hive cell OnStart when params.Namespaces.Store(ctx) returns an error — typically the backing k8s client/watch factory failed to initialize or the context was canceled during startup.

Common situations: API server unreachable at startup; RBAC denying list/watch on namespaces; context deadline exceeded because k8s client never became ready; agent shutting down concurrently.

Related errors

• unable to retrieve ConfigMap %q: %w
• unable to list nodes in cluster: %w
• failed to collect the Cluster Mesh certgen cronjob: %w
• unable to create CRDs: %w
• Kubernetes client not configured, cannot continue

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/443f67091e70124d. Report an issue: GitHub.