crowdsecurity/crowdsec · error

k8s-audit server failed: %w

Error message

k8s-audit server failed: %w

What it means

StreamingAcquisition's server goroutine fails when http.ListenAndServe returns any error other than ErrServerClosed — typically the listen address/port is invalid or already in use — so the k8s audit webhook cannot start.

Source

Thrown at pkg/acquisition/modules/kubernetesaudit/run.go:33

	"github.com/crowdsecurity/go-cs-lib/trace"

	"github.com/crowdsecurity/crowdsec/pkg/metrics"
	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

func (s *Source) StreamingAcquisition(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {
	s.outChan = out

	t.Go(func() error {
		defer trace.ReportPanic()

		s.logger.Infof("Starting k8s-audit server on %s:%d%s", s.config.ListenAddr, s.config.ListenPort, s.config.WebhookPath)

		t.Go(func() error {
			err := s.server.ListenAndServe()
			if err != nil && err != http.ErrServerClosed {
				return fmt.Errorf("k8s-audit server failed: %w", err)
			}

			return nil
		})
		<-t.Dying()
		s.logger.Infof("Stopping k8s-audit server on %s:%d%s", s.config.ListenAddr, s.config.ListenPort, s.config.WebhookPath)

		if err := s.server.Shutdown(ctx); err != nil {
			s.logger.Errorf("Error shutting down k8s-audit server: %s", err.Error())
		}

		return nil
	})

	return nil
}

func (s *Source) webhookHandler(w http.ResponseWriter, r *http.Request) {

View on GitHub (pinned to 909b515798)

Solutions

1. Choose a free listen_addr/listen_port in the source config
2. Check nothing else occupies the port (ss -ltnp)
3. Verify the address format and permissions on privileged ports

When it happens

Trigger: Thrown at pkg/acquisition/modules/kubernetesaudit/run.go:33 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a2e1e2035377e216. Report an issue: GitHub.