What causes "unable to create apiext k8s client: %w" in cilium/cilium?

Inspect the wrapped error for the exact rest.Config field that is invalid

unable to create apiext k8s client: %w

Error message

unable to create apiext k8s client: %w

What it means

The apiextensions clientset (used for CRD management) is created via apiext_clientset.NewForConfigAndClient. Failure means the clientset could not be built from the rest config and http client.

Source

Thrown at pkg/k8s/client/cell.go:185

	if s := os.Getenv("DISABLE_HTTP2"); len(s) > 0 {
		client.closeAllConns = defaultCloseAllConns
	} else {
		client.closeAllConns = func() {
			utilnet.CloseIdleConnectionsFor(rc.Transport)
		}
	}

	// Slim and K8s clients use protobuf marshalling.
	rc.ContentConfig.ContentType = `application/vnd.kubernetes.protobuf`

	client.slim, err = slim_clientset.NewForConfigAndClient(rc, httpClient)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to create slim k8s client: %w", err)
	}

	client.APIExtClientset, err = apiext_clientset.NewForConfigAndClient(rc, httpClient)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to create apiext k8s client: %w", err)
	}

	client.MCSAPIClientset, err = mcsapi_clientset.NewForConfigAndClient(rc, httpClient)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to create mcsapi k8s client: %w", err)
	}

	client.KubernetesClientset, err = kubernetes.NewForConfigAndClient(rc, httpClient)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to create k8s client: %w", err)
	}

	client.PolicyClientset, err = policy_clientset.NewForConfigAndClient(rc, httpClient)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to create policy k8s client: %w", err)
	}

	client.ClientsetGetters = ClientsetGetters{&client}

View on GitHub (pinned to ac7b90affa)

Solutions

Inspect the wrapped error for the exact rest.Config field that is invalid
Validate rc.Host and TLS settings before client construction
Confirm kubeconfig validity with kubectl
Recreate the client after fixing the config rather than retrying with the same broken config

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(rc.Host)
if err != nil || u.Host == "" {
	return fmt.Errorf("invalid API server host: %q", rc.Host)
}

Try / catch

apiext, err := apiext_clientset.NewForConfigAndClient(rc, httpClient)
if err != nil {
	log.Fatalf("apiext clientset init failed: %v", err)
}

Prevention

Validate rest.Config before constructing clientsets
Use a single shared validated rest.Config for all clientsets
Check wrapped root-cause errors rather than retrying
Keep kubeconfig valid and version-controlled

When it happens

Trigger: apiext_clientset.NewForConfigAndClient(rc, httpClient) returns error during newClientsetForUserAgent — invalid rest config (bad host, TLS) surfacing at clientset construction time.

Common situations: Same root causes as other clientset failures: malformed kubeconfig host, TLS config problems, corrupted protobuf content-type settings.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/ce5b5b0c19120633. Report an issue: GitHub.