cilium/cilium · error

unable to list ccnp pods in namespace %s: %w

Error message

unable to list ccnp pods in namespace %s: %w

What it means

For CCNP (CiliumClusterwideNetworkPolicy) tests, after waiting for the ccnp deployment in each namespace the test lists ccnp pods with the kind=<ccnpName> label to register test targets. This error wraps the ListPods failure with both namespace and underlying cause, scoped per-namespace so the failing one is identifiable.

Source

Thrown at cilium-cli/connectivity/check/deployment.go:2944

					ct.lrpClientPods[lrpPod.Name] = Pod{
						K8sClient: ct.client,
						Pod:       lrpPod.DeepCopy(),
					}
				}
			}
		}
	}

	if ct.Features[features.CCNP].Enabled {

		namespaces := []string{ccnpTestNamespace1, ccnpTestNamespace2}
		for _, ns := range namespaces {
			if err := WaitForDeployment(ctx, ct, ct.clients.src, ns, ccnpDeploymentName); err != nil {
				return err
			}
			ccnpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: "kind=" + kindCCNPName})
			if err != nil {
				return fmt.Errorf("unable to list ccnp pods in namespace %s: %w", ns, err)
			}
			for _, ccnpPod := range ccnpPods.Items {
				ct.ccnpTestPods[ns] = Pod{
					K8sClient: ct.client,
					Pod:       ccnpPod.DeepCopy(),
				}
			}
		}
	}

	clientPods, err := ct.client.ListPods(ctx, ct.params.TestNamespace, metav1.ListOptions{LabelSelector: "kind=" + kindClientName})
	if err != nil {
		return fmt.Errorf("unable to list client pods: %w", err)
	}

	for _, pod := range clientPods.Items {
		if strings.Contains(pod.Name, clientCPDeployment) {
			ct.clientCPPods[pod.Name] = Pod{

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check which namespace is named in the error and run kubectl -n <ns> get pods -l kind=<ccnpName>
2. Verify pods list RBAC in that specific namespace: kubectl auth can-i list pods -n <ns>
3. Ensure no concurrent cilium-cli runs/cleanup are deleting the test namespaces
4. Retry the suite once API server responsiveness is restored

Example fix

// before
Error: unable to list ccnp pods in namespace cilium-test-2: pods is forbidden
// after
kubectl auth can-i list pods -n cilium-test-2   # must be yes
kubectl create rolebinding ccnp-lister -n cilium-test-2 --clusterrole=pod-lister --user=<user>

for ns in <TestNamespace> <otherTestNs>; do
  kubectl auth can-i list pods -n $ns || echo "missing pod-list RBAC in $ns"
  kubectl get ns $ns >/dev/null || echo "namespace $ns missing"
done

ccnpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: "kind=" + kindCCNPName})
if err != nil {
    if apierrors.IsNotFound(err) {
        // this specific namespace vanished; skip or recreate it
        continue
    }
    return fmt.Errorf("ccnp pod listing failed in %s: %w", ns, err)
}

When it happens

Trigger: ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: "kind=" + kindCCNPName}) returns non-nil for a specific namespace ns: RBAC denial in that namespace, namespace deleted during iteration, or API error.

Common situations: Test namespaces (usually two for multi-cluster) cleaned up concurrently; service account scoped to only one namespace but the test iterates several; API throttling during many sequential ListPods calls.

Related errors

• Error listing network policies: %w
• Error listing Cilium network policies: %w
• unable to list Cilium pods: %w
• unable to list client pods: %w
• unable to list pods with lable %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/390bd14646a8bb36. Report an issue: GitHub.