cilium/cilium · error

status check failed: [%s]

Error message

status check failed: [%s]

What it means

cilium-cli's status command aggregates errors collected while checking node/agent/controller status. If any CollectionErrors accumulated during the run, it joins them into a single 'status check failed: [...]' error listing each underlying failure.

Source

Thrown at cilium-cli/cli/status.go:58

			}
			if params.Output == status.OutputJSON {
				jsonStatus, err := json.MarshalIndent(s, "", " ")
				if err != nil {
					// Report the most recent status even if an error occurred.
					fmt.Fprint(os.Stderr, s.Format())
					fatalf("Unable to marshal status to JSON:  %s", err)
				}
				fmt.Println(string(jsonStatus))
			} else {
				fmt.Print(s.Format())
			}

			if len(s.CollectionErrors) > 0 {
				errs := make([]string, 0, len(s.CollectionErrors))
				for _, e := range s.CollectionErrors {
					errs = append(errs, e.Error())
				}
				err = fmt.Errorf("status check failed: [%s]", strings.Join(errs, ", "))
			}
			return err
		},
	}
	cmd.Flags().BoolVar(&params.Wait, "wait", false, "Wait for status to report success (no errors and warnings)")
	cmd.Flags().DurationVar(&params.WaitDuration, "wait-duration", defaults.StatusWaitDuration, "Maximum time to wait for status")
	cmd.Flags().BoolVar(&params.IgnoreWarnings, "ignore-warnings", false, "Ignore warnings when waiting for status to report success")
	cmd.Flags().IntVar(&params.WorkerCount,
		"worker-count", status.DefaultWorkerCount,
		"The number of workers to use")
	cmd.Flags().StringVarP(&params.Output, "output", "o", status.OutputSummary, "Output format. One of: json, summary")
	cmd.Flags().BoolVar(&params.Interactive, "interactive", true, "Refresh the status summary output after each retry when --wait flag is specified")
	cmd.Flags().BoolVar(&params.Verbose, "verbose", false, "Print more verbose error / log messages")

	return cmd
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the joined sub-errors in brackets and address each (usually unhealthy cilium pods on specific nodes)
2. Check `kubectl -n kube-system get pods -l k8s-app=cilium` for failing pods and inspect logs
3. Increase --wait-duration if the check raced with a rollout
4. Verify you're pointed at the intended cluster/context and Cilium was installed in the expected namespace

Example fix

// before
cilium status --wait
// after
cilium status --wait --wait-duration 5m
# then: kubectl -n kube-system logs -l k8s-app=cilium --tail=100

// before running: confirm cilium pods are healthy
// kubectl -n kube-system get pods -l k8s-app=cilium

if err := cilium.Status(ctx, opts); err != nil {
	var statusErr *fmt.Errorf
	if errors.As(err, &statusErr) && strings.HasPrefix(err.Error(), "status check failed: [") {
		// parse the bracketed sub-errors and retry once pods stabilize
	}
}

When it happens

Trigger: Running `cilium status` (or the status subcommand) where one or more collection probes failed: agent not ready on some node, kube-proxy issues, controllers unhealthy, or the k8s client failing to reach pods during the wait window.

Common situations: Partially rolled-out Cilium DaemonSet leaving some nodes without healthy agents; CrashLooping cilium pods; CNI wiring problems after install/upgrade; wrong kubeconfig context pointing at a cluster without Cilium.

Related errors

• no pods found
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated
• unable to update some endpoints with new namespace labels
• no local node v4 CIDR

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/fd5528d7e1d4c81d. Report an issue: GitHub.