What causes "namespace of service %q conflict with pod %q" in cilium/cilium?

Use a service in the same namespace as the pod filter, or drop one of the filters.

namespace of service %q conflict with pod %q

Error message

namespace of service %q conflict with pod %q

What it means

checkInconsistentNamespaces (called from checkNamespaceConflicts after flag parsing) compares the namespace of every set service (fqdn) filter with the namespace of every set pod filter. If a service's namespace differs from a pod's namespace, it reports this conflict, since a pod can only talk to services in its own namespace for these filters to make sense together.

Source

Thrown at hubble/cmd/observe/flows_filter.go:251

					}
				}
			}
		}
	}
	return nil
}

// checkInconsistentNamespaces checks if the namespaces in pods and services make sense
// i.e. it checks that we don't request a service in one namespace with pods in another namespace
func checkInconsistentNamespaces(pods, services []string) error {
	for _, pod := range pods {
		podNs := namespaceFromName(pod)
		if podNs == "" {
			continue
		}
		for _, svc := range services {
			if ns := namespaceFromName(svc); podNs != ns {
				return fmt.Errorf("namespace of service %q conflict with pod %q", svc, podNs)
			}
		}
	}
	return nil
}

// checkNamespaceConflicts checks for conflicts in namespaces, pods and services
func (t *filterTracker) checkNamespaceConflicts(ff *flowpb.FlowFilter) error {
	if ff == nil {
		return nil
	}
	return errors.Join(t.ns.conflicts(ff.GetSourcePod()),
		t.ns.conflicts(ff.GetSourceService()),
		t.ns.conflicts(ff.GetDestinationPod()),
		t.ns.conflicts(ff.GetDestinationService()),
		t.srcNs.conflicts(ff.GetSourcePod()),
		t.srcNs.conflicts(ff.GetSourceService()),
		t.dstNs.conflicts(ff.GetDestinationPod()),

View on GitHub (pinned to ac7b90affa)

Solutions

Use a service in the same namespace as the pod filter, or drop one of the filters.
Fully qualify the fqdn with the correct namespace (e.g. my-svc.default.svc.cluster.local for a default-namespace pod).
Run two separate observe commands to inspect cross-namespace traffic.

Example fix

// before
hubble observe --from-pod default/app --to-fqdn other-ns.svc.cluster.local
// after
hubble observe --from-pod default/app --to-fqdn my-svc.default.svc.cluster.local

Defensive patterns

Strategy: validation

Validate before calling

func sameNamespace(pods, services []string) bool {
    for _, p := range pods {
        pns := namespaceFromName(p)
        if pns == "" { continue }
        for _, s := range services {
            if ns := namespaceFromName(s); ns != pns { return false }
        }
    }
    return true
}

Try / catch

if err := checkNamespaceConflicts(...); err != nil {
    if strings.Contains(err.Error(), "conflict with pod") {
        // align service fqdn namespace or split queries
    }
    return err
}

Prevention

Fully qualify fqdn filters with the pod's namespace (svc.ns.svc.cluster.local)
Avoid mixing pod and service filters across namespaces; run separate queries
Validate generated filter pairs in CI before invoking hubble

When it happens

Trigger: Setting both a pod filter (e.g. --from-pod ns1/pod) and a service/fqdn filter (e.g. --to-fqdn ns2.svc.cluster.local) whose namespaces differ; the check walks pods×services and fails on the first mismatch.

Common situations: Cross-namespace traffic debugging attempts with combined pod+service filters; fqdn given without namespace or in the wrong namespace; copy-paste of pod name and service name from different namespaces.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9376049fbbbce5a6. Report an issue: GitHub.