cilium/cilium · error

failed to write configurations to %s: %w

Error message

failed to write configurations to %s: %w

What it means

This error is returned by the `cilium-dbg build-config` command when the call to resolver.WriteConfigurations fails after the destination directory has already been created. It wraps the underlying error with the destination path so the developer can see which directory the resolver could not write configuration files into. The build-config command renders the effective Cilium configuration and shuts down after writing, so any failure here aborts config generation.

Source

Thrown at cilium-dbg/cmd/build-config.go:171

			} else if len(parsed) == 2 {
				source.Namespace = parsed[0]
				source.Name = parsed[1]
			}
		}
		sources = append(sources, source)
	}

	config, err := resolver.ResolveConfigurations(ctx, bc.log, bc.client, bc.cfg.NodeName, sources, bc.cfg.AllowConfigKeys, bc.cfg.DenyConfigKeys)
	if err != nil {
		return fmt.Errorf("failed to resolve configurations: %w", err)
	}

	if err := os.MkdirAll(bc.cfg.Dest, 0777); err != nil {
		return fmt.Errorf("failed to create config directory %s: %w", bc.cfg.Dest, err)
	}

	if err := resolver.WriteConfigurations(ctx, bc.log, bc.cfg.Dest, config); err != nil {
		return fmt.Errorf("failed to write configurations to %s: %w", bc.cfg.Dest, err)
	}

	bc.shutdowner.Shutdown()
	return nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check permissions on the destination directory (bc.cfg.Dest) and ensure the process user can write to it (it is created with 0777 but may still be restricted by mount options/SELinux).
2. Inspect the wrapped error (%w) printed after this message — it names the real cause (EACCES, ENOSPC, EROFS, etc.) and fix accordingly.
3. Verify the destination path is not on a read-only volume and that disk space is available (df -h).
4. If running in Kubernetes, check the pod's securityContext (runAsUser, fsGroup) and volume mount readOnly flags.

Example fix

// before
cmd := exec.Command("cilium-dbg", "build-config", "--dest", "/etc/cilium") // dir mounted read-only
// after
// mount the volume read-write and ensure the run-as user owns it:
// securityContext:
//   runAsUser: 0
// volumes:
//   - name: cilium-config
//     emptyDir: {} # not readOnly

info, err := os.Stat(dest)
if err == nil && !info.IsDir() { return fmt.Errorf("%s is not a directory", dest) }
probe := filepath.Join(dest, ".write-probe")
if err := os.WriteFile(probe, nil, 0600); err != nil { return fmt.Errorf("dest %s not writable: %w", dest, err) }
os.Remove(probe)

When it happens

Trigger: Running `cilium-dbg build-config` when resolver.WriteConfigurations(ctx, bc.log, bc.cfg.Dest, config) returns an error — e.g. the destination directory exists but is not writable, the filesystem is full or read-only, or the resolver hits an internal error serializing the configuration.

Common situations: Running the container as a non-root user without write permission on the --dest directory; mounting the destination path read-only in a pod; disk-full conditions on the node; SELinux/AppArmor denials on the config directory; a resolver bug or invalid config values that fail during rendering.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• failed to create config directory %s: %w
• create directory: %w
• create config file: %w
• unable to create cilium sysctl overwrites config: %w
• Failed to open file %s for writing: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/81b691d663e99804. Report an issue: GitHub.