cilium/cilium · error

unable to retrieve helm meta from release %s: %w

Error message

unable to retrieve helm meta from release %s: %w

What it means

Returned by `Client.GetHelmMetadata` when Helm's `GetMetadata` action fails for the named release after the action config initialized. The wrapped error is Helm's own — most commonly 'release: not found' (wrong release name/namespace, or Cilium not installed via Helm) or storage/read failures for the release record.

Source

Thrown at cilium-cli/k8s/client.go:1184

	}
	return valuesBuf.String(), nil
}

// GetHelmMetadata is the function for cilium cli sysdump to collect the helm metadata from the release directly
func (c *Client) GetHelmMetadata(_ context.Context, releaseName string, namespace string) (string, error) {
	if c.RESTClientGetter == nil {
		return "", fmt.Errorf("no RESTClientGetter for Helm Values")
	}
	helmDriver := ""
	actionConfig := action.Configuration{}
	if err := actionConfig.Init(c.RESTClientGetter, namespace, helmDriver); err != nil {
		return "", err
	}

	client := action.NewGetMetadata(&actionConfig)
	meta, err := client.Run(releaseName)
	if err != nil {
		return "", fmt.Errorf("unable to retrieve helm meta from release %s: %w", releaseName, err)
	}

	buf := new(bytes.Buffer)
	if err = output.EncodeYAML(buf, meta); err != nil {
		return "", fmt.Errorf("unable to parse helm metas from release %s: %w", releaseName, err)
	}
	return buf.String(), nil
}

// CreateEphemeralContainer will create a EphemeralContainer (debug container) in the specified pod.
// EphemeralContainers are special containers which can be added after-the-fact in running pods. They're
// useful for debugging, either when the target container image doesn't have necessary tools, or because
// the pod has no running containers due to a crash.
//
// see https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/
//
// EphemeralContainers were added in there current form (behind a feature gate) in 1.22. They are scheduled for GA in v1.25.
func (c *Client) CreateEphemeralContainer(ctx context.Context, pod *corev1.Pod, ec *corev1.EphemeralContainer) (*corev1.Pod, error) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Run `helm list -A` and confirm the exact releaseName and namespace
2. Install Cilium through Helm if it wasn't (no metadata exists for manifest installs)
3. Check RBAC for reading Helm storage secrets in the release namespace
4. Inspect the wrapped Helm error: 'not found' → fix name/namespace; storage errors → repair Helm storage

Example fix

// before
meta, err := client.GetHelmMetadata(ctx, "cilium", "cilium-system") // wrong namespace, release is in kube-system
// after
ns := "kube-system" // verify with: helm list -A
meta, err := client.GetHelmMetadata(ctx, "cilium", ns)
if err != nil && strings.Contains(err.Error(), "not found") {
    return fmt.Errorf("cilium helm release not found in %s — was Cilium installed via Helm?", ns)
}

meta, err := helmGetMetadata.Run(releaseName) // or helm list first
if err != nil && strings.Contains(err.Error(), "not found") {
    return fmt.Errorf("helm release %q not found in %q", releaseName, namespace)
}

meta, err := client.GetHelmMetadata(ctx, release, ns)
if err != nil && strings.Contains(err.Error(), "unable to retrieve helm meta") {
    if strings.Contains(err.Error(), "not found") {
        return fmt.Errorf("no cilium helm release %s/%s — manifest install?", ns, release)
    }
    return fmt.Errorf("helm storage error: %w", err)
}

When it happens

Trigger: Calling `GetHelmMetadata(ctx, releaseName, namespace)` where the Helm release does not exist at that name/namespace (custom release name, manifest-installed Cilium), the release was purged, or the Helm storage backend (secret/configmap) is unreadable due to RBAC or corruption.

Common situations: Cilium deployed with manifests/kustomize so no Helm release exists; cilium-cli sysdump run against a cluster where the release lives in a non-default namespace; RBAC denying secret reads in kube-system; failed/pending helm upgrade leaving the release in a non-queryable state.

Related errors

• unable to retrieve helm value from release %s: %w
• could not find container %q in pod %q with namespace %q
• could not find container %s
• could not create exec pod: %w
• exec pod %q for namespace %q never reached ready status: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/d9f9d25f16a2f01e. Report an issue: GitHub.