What causes "unable to list lrp pods: %w" in cilium/cilium?

Inspect the wrapped cause and run kubectl -n get pods -l kind= manually

unable to list lrp pods: %w

Error message

unable to list lrp pods: %w

What it means

When the LocalRedirectPolicy feature is enabled, the test lists lrp pods by the kind=<lrpName> label after deployment to register backend/direct-response pods. This error wraps the ListPods failure with %w, retaining the API cause. The LRP portion of validation is skipped on failure since the pods can't be tracked.

Source

Thrown at cilium-cli/connectivity/check/deployment.go:2916

		return ct.perfServerPod[i].Pod.Name < ct.perfServerPod[j].Pod.Name
	})
	sort.SliceStable(ct.perfClientPods, func(i, j int) bool {
		return ct.perfClientPods[i].Pod.Name < ct.perfClientPods[j].Pod.Name
	})

	return nil
}

func (ct *ConnectivityTest) validateDeployment(ctx context.Context) error {
	srcDeployments, dstDeployments := ct.deploymentList()
	if err := ct.validateDeploymentCommon(ctx, srcDeployments, dstDeployments); err != nil {
		return err
	}

	if ct.Features[features.LocalRedirectPolicy].Enabled {
		lrpPods, err := ct.client.ListPods(ctx, ct.params.TestNamespace, metav1.ListOptions{LabelSelector: "kind=" + kindLrpName})
		if err != nil {
			return fmt.Errorf("unable to list lrp pods: %w", err)
		}
		for _, lrpPod := range lrpPods.Items {
			if v, hasLabel := lrpPod.GetLabels()["lrp"]; hasLabel {
				if v == "backend" {
					ct.lrpBackendPods[lrpPod.Name] = Pod{
						K8sClient: ct.client,
						Pod:       lrpPod.DeepCopy(),
					}
				} else if v == "client" {
					ct.lrpClientPods[lrpPod.Name] = Pod{
						K8sClient: ct.client,
						Pod:       lrpPod.DeepCopy(),
					}
				}
			}
		}
	}

View on GitHub (pinned to ac7b90affa)

Solutions

Inspect the wrapped cause and run kubectl -n <TestNamespace> get pods -l kind=<lrpName> manually
Grant pods list permission: kubectl auth can-i list pods -n <TestNamespace>, add rolebinding if no
Recreate the test namespace if it was deleted: cilium-cli connectivity test will recreate it on next run
Retry; if the feature isn't needed, this path only runs with LocalRedirectPolicy enabled

Example fix

// before
Error: unable to list lrp pods: namespaces "cilium-test" not found
// after
kubectl create namespace cilium-test
# or simply re-run the test which recreates the namespace

Defensive patterns

Strategy: retry

Validate before calling

kubectl auth can-i list pods -n <TestNamespace>
kubectl get ns <TestNamespace>
# feature gate: only needed when LocalRedirectPolicy is enabled
kubectl -n kube-system exec ds/cilium -- cilium-dbg status | grep -i lrp

Try / catch

lrpPods, err := ct.client.ListPods(ctx, ns, metav1.ListOptions{LabelSelector: "kind=" + kindLrpName})
if err != nil {
    if apierrors.IsForbidden(err) {
        return fmt.Errorf("cannot list LRP pods (check RBAC): %w", err)
    }
    // transient: retry with backoff before failing the run
    return retryBeforeFail(ctx, 3, 2*time.Second, func() error { return listLrpPods(ctx) })
}

Prevention

Verify LRP feature support before enabling it in test flags
Keep test namespace lifecycle within a single cilium-cli invocation
Confirm pods list permission for all cluster contexts used (src and dst)

When it happens

Trigger: ct.client.ListPods(ctx, TestNamespace, metav1.ListOptions{LabelSelector: "kind=" + kindLrpName}) returns non-nil: RBAC forbidden, namespace gone, or API server error. Only occurs when ct.Features[features.LocalRedirectPolicy].Enabled.

Common situations: Restricted RBAC profiles blocking pod list in the test namespace; namespace removed by a concurrent cleanup; temporary API server unavailability during a long test run.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/f90bdd2bcf4a379c. Report an issue: GitHub.