cilium/cilium · error

unable to determine status of pod %q: %w

Error message

unable to determine status of pod %q: %w

What it means

When the per-pod status collector fails for a specific Cilium agent pod, this error wraps the underlying cause along with the pod name. The only tolerated case is ErrClusterMeshStatusNotAvailable when no remote clusters are expected (older agents without clustermesh status support). Any other collector error aborts the whole status operation.

Source

Thrown at cilium-cli/clustermesh/clustermesh.go:814

		// Additionally skip the configuration of the local cluster, if present
		if name != k.clusterName && strings.Contains(string(cfg), "endpoints:") {
			stats.Clusters[name] = &ClusterStats{}
			expected = append(expected, name)
		}
	}

	pods, err := k.client.ListPods(ctx, k.params.Namespace, metav1.ListOptions{LabelSelector: selector})
	if err != nil {
		return nil, fmt.Errorf("unable to list pods: %w", err)
	}

	for _, pod := range pods.Items {
		s, err := collector(ctx, pod.Name)
		if err != nil {
			if len(expected) == 0 && errors.Is(err, status.ErrClusterMeshStatusNotAvailable) {
				continue
			}
			return nil, fmt.Errorf("unable to determine status of pod %q: %w", pod.Name, err)
		}

		stats.parseAgentStatus(pod.Name, expected, s)
	}

	if len(pods.Items) > 0 {
		stats.Connected.Avg /= float64(len(pods.Items))
	}

	return stats, nil
}

func (k *K8sClusterMesh) Status(ctx context.Context) (*Status, error) {
	err := k.GetClusterConfig(ctx)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the named pod's health: kubectl -n kube-system get pod <name> and its logs
2. Retry once the pod is Running/Ready (or pass --wait to retry automatically)
3. If caused by old Cilium versions lacking status support, upgrade all agents
4. Verify no policy blocks connectivity between the CLI host and the pod

Example fix

// before: hard failure on any pod
return nil, fmt.Errorf("unable to determine status of pod %q: %w", pod.Name, err)
// after: tolerate unavailable-status on old agents
if errors.Is(err, status.ErrClusterMeshStatusNotAvailable) { continue }

// Ensure the target agent pod is ready first
pod, err := cs.CoreV1().Pods("kube-system").Get(ctx, podName, metav1.GetOptions{})
if err != nil || !podutil.IsPodReady(pod) { return retryLater }

if err != nil {
    if errors.Is(err, status.ErrClusterMeshStatusNotAvailable) { return nil } // old agent, ignore
    if strings.Contains(err.Error(), "unable to determine status of pod") { return retryAfter(ctx, time.Minute) }
}

When it happens

Trigger: collector(ctx, pod.Name) fails for an agent pod — e.g. the agent's /healthz or status endpoint is unreachable, the pod is being deleted, or exec/port-forward to the pod fails; and it is not an ignorable ErrClusterMeshStatusNotAvailable.

Common situations: Agent pod restarting during the check; network policy blocking pod access; mixed Cilium versions where some agents predate clustermesh status reporting; host under heavy load.

Related errors

• cluster is unset
• namespace is unset
• name is unset
• exportCreationTimestamp is unset
• AddrCluster.UnmarshalJSON: bad address

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4e5d28b39b821eab. Report an issue: GitHub.