crowdsecurity/crowdsec · error

kubernetes client is not initialized

Error message

kubernetes client is not initialized

What it means

followPodLogs reads the Kubernetes client from the Source and returns this error when the client is nil, i.e. Configure() was never called (or failed to initialize the clientset) before log tailing was attempted. It is an internal state guard preventing a nil-pointer panic inside the Kubernetes API calls.

Source

Thrown at pkg/acquisition/modules/kubernetes/run.go:191

		s.stopPods()
		wg.Wait()
		return watchErr
	}
	s.stopPods()
	wg.Wait()

	return nil
}

func (s *Source) Dump() any {
	return s
}

func (s *Source) followPodLogs(ctx context.Context, ns string, pod string, container string, out chan pipeline.Event,
	onLineFunc func(string, string, chan pipeline.Event) error) error {
	client := s.client
	if client == nil {
		return errors.New("kubernetes client is not initialized")
	}

	// TailLines: 0 means "no historical catch-up, only new lines from now on".
	// Unlike SinceTime, this stays correct across reconnects: a fixed SinceTime
	// would cause every retry to re-stream everything since the original call.
	tailLines := int64(0)
	req := client.CoreV1().Pods(ns).GetLogs(pod, &corev1.PodLogOptions{
		Container:  container,
		Follow:     true,
		Timestamps: false,
		TailLines:  &tailLines,
	})
	fn := func() error {
		if err := ctx.Err(); err != nil {
			return nil
		}
		stream, err := req.Stream(ctx)
		if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure Source.Configure() is called and its error checked before running the acquisition.
2. Fix the underlying client initialization failure (valid kubeconfig path, or proper in-cluster environment/ServiceAccount).
3. In tests, inject a fake clientset into s.client before invoking followPodLogs.

Example fix

// before
src := kubernetes.Source{}
src.followPodLogs(ctx, ...)

// after
var src kubernetes.Source
if err := src.Configure(ctx, cfg, logger, metrics.AcquisitionMetricsLevelNone); err != nil {
    log.Fatal(err)
}
src.followPodLogs(ctx, ...)

if src.Client == nil {
    return fmt.Errorf("kubernetes source not configured: call Configure() first")
}

func clientReady(s *kubernetes.Source) bool { return s.Client != nil }

When it happens

Trigger: Calling followPodLogs (directly in tests, or via the source's run path) on a Source whose s.client is nil — typically when Configure was skipped or its error ignored.

Common situations: Tests constructing a Source manually without calling Configure; in production, an earlier failed Kubernetes API client init (bad kubeconfig, no in-cluster service account) whose error was swallowed before tailing started.

Related errors

• selector must be set in kubernetes acquisition
• failed to process line
• listen_addr cannot be empty
• listen_port cannot be empty
• webhook_path cannot be empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b5adb0fc12d4e0de. Report an issue: GitHub.