What causes "replicas count is zero" in cilium/cilium?

Check deployment spec replicas: 'kubectl get deploy -o jsonpath={.spec.replicas}' and scale back up if 0

replicas count is zero

Error message

replicas count is zero

What it means

The Deployment reports status.replicas == 0, meaning no pods are currently part of the deployment. cilium-cli fails fast on this rather than proceeding with a deployment that has no backing pods.

Source

Thrown at cilium-cli/k8s/client.go:285

}

func (c *Client) CheckDeploymentStatus(ctx context.Context, namespace, deployment string) error {
	d, err := c.GetDeployment(ctx, namespace, deployment, metav1.GetOptions{})
	if err != nil {
		return err
	}

	if d == nil {
		return fmt.Errorf("deployment is not available")
	}

	if d.Status.ObservedGeneration != d.Generation {
		return fmt.Errorf("observed generation (%d) is older than generation of the desired state (%d)",
			d.Status.ObservedGeneration, d.Generation)
	}

	if d.Status.Replicas == 0 {
		return fmt.Errorf("replicas count is zero")
	}

	if d.Status.AvailableReplicas != d.Status.Replicas {
		return fmt.Errorf("only %d of %d replicas are available", d.Status.AvailableReplicas, d.Status.Replicas)
	}

	if d.Status.ReadyReplicas != d.Status.Replicas {
		return fmt.Errorf("only %d of %d replicas are ready", d.Status.ReadyReplicas, d.Status.Replicas)
	}

	if d.Status.UpdatedReplicas != d.Status.Replicas {
		return fmt.Errorf("only %d of %d replicas are up-to-date", d.Status.UpdatedReplicas, d.Status.Replicas)
	}

	return nil
}

func (c *Client) CreateNamespace(ctx context.Context, namespace *corev1.Namespace, opts metav1.CreateOptions) (*corev1.Namespace, error) {

View on GitHub (pinned to ac7b90affa)

Solutions

Check deployment spec replicas: 'kubectl get deploy <name> -o jsonpath={.spec.replicas}' and scale back up if 0
Inspect pods/ReplicaSet events: 'kubectl describe deployment <name>' and 'kubectl get rs,pods -l <selector>'
Check node taints/resource limits that block pod scheduling
Wait for rollout if this is a transient state during upgrade

Example fix

// before
kubectl scale deployment cilium -n kube-system --replicas=0
// after
kubectl scale deployment cilium -n kube-system --replicas=1

Defensive patterns

Strategy: validation

Validate before calling

d, _ := clientset.AppsV1().Deployments(ns).Get(ctx, name, metav1.GetOptions{})
if d != nil && (d.Spec.Replicas == nil || *d.Spec.Replicas == 0) {
    return fmt.Errorf("deployment %s/%s is scaled to zero", ns, name)
}

Type guard

func hasReplicas(d *appsv1.Deployment) bool {
    return d != nil && d.Status.Replicas > 0
}

Try / catch

err := client.CheckDeploymentStatus(ctx, ns, name)
if err != nil {
    if err.Error() == "replicas count is zero" {
        // scale deployment back up, then retry
    }
    return err
}

Prevention

Never scale cilium deployments to 0 permanently
Check taints/resources so pods can schedule
Include replica checks in preflight validation

When it happens

Trigger: CheckDeploymentStatus reads a Deployment whose spec has 0 replicas or whose ReplicaSet produced no pods — e.g. during rollout, scale-to-zero, or scheduling failure.

Common situations: Cilium deployment scaled to 0 manually or by resource constraints; scheduling failures (taints, insufficient resources) preventing pod creation; rollout just started.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/af27fa643f0bb095. Report an issue: GitHub.