cilium/cilium · error

unable to list Cilium pods: %w

Error message

unable to list Cilium pods: %w

What it means

initTargetCiliumPods in cilium-cli/bgp/bgp.go lists Cilium agent pods via s.client.ListPods in the Cilium namespace, optionally filtered by spec.FieldName for NodeName. If the Kubernetes API list call fails it wraps the cause as "unable to list Cilium pods: %w". GetPeeringState and GetRoutes both depend on this, so BGP status commands fail at the first step.

Source

Thrown at cilium-cli/bgp/bgp.go:55

func NewStatus(client *k8s.Client, p Parameters) *Status {
	return &Status{
		client: client,
		params: p,
	}
}

// initTargetCiliumPods stores cilium agent pods in the status.ciliumPods.
// If node selector option is specified then only that nodes' cilium-agent
// pod is stored else all cilium-agents in the cluster are stored.
func (s *Status) initTargetCiliumPods(ctx context.Context) error {
	opts := metav1.ListOptions{LabelSelector: s.params.AgentPodSelector}
	if s.params.NodeName != "" {
		opts.FieldSelector = fmt.Sprintf("spec.nodeName=%s", s.params.NodeName)
	}

	ciliumPods, err := s.client.ListPods(ctx, s.params.CiliumNamespace, opts)
	if err != nil {
		return fmt.Errorf("unable to list Cilium pods: %w", err)
	}

	for _, ciliumPod := range ciliumPods.Items {
		s.ciliumPods = append(s.ciliumPods, ciliumPod.DeepCopy())
	}
	return nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify kubeconfig connectivity: kubectl get pods -n <cilium-ns> must succeed with the same credentials
2. Pass the correct --namespace flag for the Cilium installation namespace
3. Check RBAC allows list/get pods in that namespace for your user/serviceaccount
4. If using --node-name filter, confirm the node name matches spec.nodeName exactly

Example fix

// before
cilium bgp peers  # assumes default 'kube-system'
// after
cilium bgp peers --namespace cilium

pods, err := clientset.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{})
if err != nil {
    return fmt.Errorf("kubeconfig/RBAC check failed: %w", err)
}

func isListErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "unable to list Cilium pods")
}

if err := status.GetPeeringState(ctx); err != nil {
    if isListErr(err) {
        // fix kubeconfig context / namespace / RBAC, then retry
    }
    return err
}

When it happens

Trigger: Calling GetPeeringState/GetRoutes when the API server is unreachable, the kubeconfig context is wrong, RBAC forbids listing pods in the Cilium namespace, or the Cilium namespace name does not match the cluster's actual namespace.

Common situations: cilium-cli pointed at the wrong cluster/context; custom cilium namespace (e.g. kube-system vs cilium) not passed via --namespace; expired/stale kubeconfig credentials; network policy or RBAC blocking pod list in a restricted cluster.

Related errors

• unable to list nodes: %w
• failed to collect Kubernetes version: %w
• failed to collect Kubernetes events: %w
• failed to collect Kubernetes namespaces: %w
• failed to collect Kubernetes pods: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/eaeae47286c9f446. Report an issue: GitHub.