crowdsecurity/crowdsec · error

can't create a kubernetes client for namespace=%q selector=%

Error message

can't create a kubernetes client for namespace=%q selector=%q: %w

What it means

initClient builds a client-go config and calls kubernetes.NewForConfig; client construction failed (invalid kubeconfig, unreachable cluster settings, bad context), so the kubernetes source cannot start streaming pods for the given namespace/selector.

Source

Thrown at pkg/acquisition/modules/kubernetes/run.go:51

	return fmt.Sprintf("%s/%s uid=%s phase=%s rv=%s node=%s",
		p.Namespace,
		p.Name,
		p.UID,
		p.Status.Phase,
		p.ResourceVersion,
		p.Spec.NodeName,
	)
}

func (s *Source) initClient() error {
	cfg, err := s.config.buildClientConfig(s.logger)
	if err != nil {
		return fmt.Errorf("building kubernetes client config for namespace=%q selector=%q: %w", s.config.Namespace, s.config.Selector, err)
	}

	client, err := kubernetes.NewForConfig(cfg)
	if err != nil {
		return fmt.Errorf("can't create a kubernetes client for namespace=%q selector=%q: %w", s.config.Namespace, s.config.Selector, err)
	}

	s.client = client

	return nil
}

func (s *Source) initCancels() {
	s.mu.Lock()
	s.cancels = map[types.UID]context.CancelFunc{}
	s.mu.Unlock()
}

func (s *Source) Stream(ctx context.Context, out chan pipeline.Event) error {
	var wg sync.WaitGroup

	s.logger.WithFields(log.Fields{
		"namespace": s.config.Namespace,

View on GitHub (pinned to 909b515798)

Solutions

1. Validate the apiserver URL and CA data in the kubeconfig
2. Re-generate credentials (kubeconfig or service account token)
3. Run 'kubectl get pods' with the same context to confirm it works

When it happens

Trigger: Thrown at pkg/acquisition/modules/kubernetes/run.go:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/471b40b5cbb147e5. Report an issue: GitHub.