cilium/cilium · error

unable to retrieve ConfigMap %q: %w

Error message

unable to retrieve ConfigMap %q: %w

What it means

At the start of feature detection, cilium-cli GETs the cilium-config ConfigMap (defaults.ConfigMapName) in the Cilium namespace. This error wraps any failure of that Get, so detection aborts before any feature is extracted.

Source

Thrown at cilium-cli/connectivity/check/features.go:350

		}
	} else if minVersion, err := ct.DetectMinimumCiliumVersion(ctx); err != nil {
		defaultVersion := helm.GetDefaultVersionString()
		ct.Warnf("Unable to detect Cilium version, assuming %v for connectivity tests: %s", defaultVersion, err)
		ct.CiliumVersion, err = semver.ParseTolerant(defaultVersion)
		if err != nil {
			return err
		}
	} else {
		ct.CiliumVersion = *minVersion
	}
	return nil
}

func (ct *ConnectivityTest) detectFeatures(ctx context.Context) error {
	initialized := false
	cm, err := ct.client.GetConfigMap(ctx, ct.params.CiliumNamespace, defaults.ConfigMapName, metav1.GetOptions{})
	if err != nil {
		return fmt.Errorf("unable to retrieve ConfigMap %q: %w", defaults.ConfigMapName, err)
	}
	if cm.Data == nil {
		return fmt.Errorf("ConfigMap %q does not contain any configuration", defaults.ConfigMapName)
	}

	// Extract cluster-wide features once outside the loop
	clusterFeatures := features.Set{}
	clusterFeatures.ExtractFromCiliumVersion(ct.CiliumVersion)
	clusterFeatures.ExtractFromConfigMap(cm)
	clusterFeatures.ExtractFromNodes(ct.nodesWithoutCilium)
	ct.extractFeaturesFromK8sCluster(ctx, clusterFeatures)
	err = ct.extractFeaturesFromCRDs(ctx, clusterFeatures)
	if err != nil {
		return err
	}
	err = ct.extractFeaturesFromDNSConfig(ctx, clusterFeatures)
	if err != nil {
		return err

View on GitHub (pinned to ac7b90affa)

Solutions

1. Find the correct namespace: kubectl get ns | grep cilium and pass the right namespace to the CLI
2. Verify the ConfigMap exists: kubectl -n <cilium-ns> get configmap cilium-config
3. If Cilium was installed purely via Helm, ensure cilium-config is still created or upgrade cilium-cli to match the install method
4. Fix kubeconfig/RBAC so the client can read configmaps in the Cilium namespace

Example fix

// before: assuming default namespace
ct := helpers.NewConnectivityTest(..., params) // params.CiliumNamespace left as default
if err := ct.DetectFeatures(ctx); err != nil { ... }
// after: resolve namespace before detection
ns, err := helpers.GetCiliumNamespace(ctx, client)
if err != nil { return err }
params.CiliumNamespace = ns
if err := ct.DetectFeatures(ctx); err != nil { ... }

// pre-flight namespace + configmap check before detectFeatures
nsOK, _ := client.HasNamespace(ctx, params.CiliumNamespace)
if !nsOK { return fmt.Errorf("cilium namespace %s not found", params.CiliumNamespace) }
if _, err := client.GetConfigMap(ctx, params.CiliumNamespace, "cilium-config", metav1.GetOptions{}); err != nil {
	return fmt.Errorf("cilium-config missing in %s: %w", params.CiliumNamespace, err)
}

func isConfigMapGetError(err error) bool { return err != nil && !apierrors.IsNotFound(err) }

if err := ct.DetectFeatures(ctx); err != nil {
	if strings.Contains(err.Error(), "unable to retrieve ConfigMap") {
		var se *apierrors.StatusError
		if errors.As(errors.Unwrap(err), &se) && se.Status().Code == http.StatusNotFound {
			log.Warnf("cilium-config not found in %s; check --cilium-namespace", ct.params.CiliumNamespace)
		}
	}
	return err
}

When it happens

Trigger: ct.client.GetConfigMap(ctx, ct.params.CiliumNamespace, defaults.ConfigMapName, metav1.GetOptions{}) errors: wrong --cilium-namespace, ConfigMap absent, 403 Forbidden, or API server unreachable.

Common situations: Cilium installed in a non-default namespace but CLI not told (or default changed); cilium-config deleted/renamed in newer installs (Helm-managed values); RBAC restricting configmap reads; wrong kubeconfig context.

Related errors

• unable to update some endpoints with new namespace labels
• unable to patch ConfigMap %s with patch %q: %w
• unable get ConfigMap %q: %w
• unable to retrieve dst cluster ConfigMap %q: %w
• unable get ConfigMap %q: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/edb430e555fec9fe. Report an issue: GitHub.