cilium/cilium · error

failed to lookup container port with service port %d: %w

Error message

failed to lookup container port with service port %d: %w

What it means

PortForwardService resolves the service port to a container port via kutil.LookupContainerPortNumberByServicePort, matching the service port to a pod container's targetPort. If no container on the selected pod exposes that port, this wrapped error is returned.

Source

Thrown at pkg/k8s/portforward/portforward.go:157

	if err != nil {
		return nil, fmt.Errorf("failed to get service %q: %w", name, err)
	}

	pod, err := pf.getFirstPodForService(ctx, svc)
	if err != nil {
		return nil, fmt.Errorf("failed to get service %q: %w", name, err)
	}

	if svcPort == 0 {
		if len(svc.Spec.Ports) == 0 {
			return nil, fmt.Errorf("service %q doesn't have any ports", name)
		}
		svcPort = svc.Spec.Ports[0].Port
	}

	containerPort, err := kutil.LookupContainerPortNumberByServicePort(*svc, *pod, svcPort)
	if err != nil {
		return nil, fmt.Errorf("failed to lookup container port with service port %d: %w", svcPort, err)
	}

	p := PortForwardParameters{
		Namespace:  pod.Namespace,
		Pod:        pod.Name,
		Ports:      []string{fmt.Sprintf("%d:%d", localPort, containerPort)},
		Addresses:  nil, // default is localhost
		OutWriters: OutWriters{Out: nil, ErrOut: nil},
	}

	res, err := pf.PortForward(ctx, p)
	if err != nil {
		return nil, fmt.Errorf("failed to port forward: %w", err)
	}

	return &PortForwardServiceResult{
		ForwardedPort: res.ForwardedPorts[0],
	}, nil

View on GitHub (pinned to ac7b90affa)

Solutions

1. Compare service spec.ports[].targetPort with the container's containerPort: kubectl get svc,pod -o yaml
2. Update the service targetPort to match the container's exposed port
3. Pass the correct svcPort that exists on the service and maps to a declared container port
4. If multi-container, ensure the container holding the port declares containerPort

Example fix

// before
// service: port 80 -> targetPort 8080, but container exposes 9090
res, err := pf.PortForwardService(ctx, ns, name, 8080, 80) // lookup fails
// after
// fix container spec: containerPort: 8080 (or change service targetPort to 9090)
res, err := pf.PortForwardService(ctx, ns, name, 8080, 80)

svc, _ := clientset.CoreV1().Services(ns).Get(ctx, name, metav1.GetOptions{})
pod, _ := getFirstPod(clientset, svc)
for _, p := range svc.Spec.Ports {
  if p.Port == svcPort && containerDeclaresPort(pod, p.TargetPort) {
    return nil // safe to forward
  }
}
return fmt.Errorf("svcPort %d has no matching container port", svcPort)

func containerDeclaresPort(pod *corev1.Pod, port intstr.IntOrString) bool {
  for _, c := range pod.Spec.Containers {
    for _, cp := range c.Ports {
      if int(cp.ContainerPort) == port.IntValue() { return true }
    }
  }
  return false
}

When it happens

Trigger: Calling PortForwardService with a svcPort that does not correspond to any containerPort on the pod behind the service — e.g. service port 80 maps to targetPort 8080 but the pod's containers don't declare 8080, or a numeric targetPort mismatch.

Common situations: Container port changed in a new image version while the service still points at the old targetPort; forwarding to the wrong service port number; pods whose containerPort declarations were omitted; multi-container pods where the port belongs to a different container.

Related errors

• failed to retrieve prometheus metrics for pod %s on node %s:
• failed to port forward: %w
• failed to port forward: %w
• failed to port forward: %w
• Error while creating k8s dialer: (websocket) %w, (spdy) %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/c4c53570e02ddc02. Report an issue: GitHub.