crowdsecurity/crowdsec · error

kubernetes informer unauthorized for namespace=%q selector=%

Error message

kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w

What it means

The pod informer's watch error handler reports that the kubernetes API rejected the watch as Unauthorized (expired/invalid credentials). The error is sent to watchErrCh so Stream restarts the datasource with fresh credentials.

Source

Thrown at pkg/acquisition/modules/kubernetes/run.go:104

		informers.WithTweakListOptions(func(o *metav1.ListOptions) {
			// We set the LabelSelector on the ListOptions to filter pods at the
			// API level, so we only get events for pods that match our
			// selector. This is more efficient than getting all pod events and
			// filtering them in our event handlers.
			o.LabelSelector = s.config.Selector
		}),
	)
	inf := f.Core().V1().Pods().Informer()
	if err := inf.SetWatchErrorHandler(func(_ *cache.Reflector, watchErr error) {
		fields := log.Fields{
			"namespace": s.config.Namespace,
			"selector":  s.config.Selector,
			"error":     watchErr,
		}
		if apierrors.IsUnauthorized(watchErr) {
			s.logger.WithFields(fields).Error("kubernetes informer received Unauthorized, forcing datasource restart")
			select {
			case watchErrCh <- fmt.Errorf("kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w", s.config.Namespace, s.config.Selector, s.config.UniqueId, watchErr):
			default:
			}
			cancelInformer()
			return
		}
		s.logger.WithFields(fields).Warn("kubernetes informer watch error")
	}); err != nil {
		return fmt.Errorf("while setting watch error handler for namespace=%q selector=%q: %w", s.config.Namespace, s.config.Selector, err)
	}

	// We ignore the ResourceEventHandlerRegistration returned by
	// AddEventHandler since we don't need to remove the handlers until shutdown,
	// and we will stop the entire informer at that time.
	s.logger.WithFields(log.Fields{
		"namespace": s.config.Namespace,
		"selector":  s.config.Selector,
	}).Info("adding kubernetes event handler")
	_, err = inf.AddEventHandler(cache.ResourceEventHandlerFuncs{

View on GitHub (pinned to 909b515798)

Solutions

1. Renew the kubeconfig or service-account credentials
2. Verify RBAC allows list/watch on pods in the namespace
3. Check that the token has not expired; restart crowdsec to re-authenticate

When it happens

Trigger: Thrown at pkg/acquisition/modules/kubernetes/run.go:104 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6da6c50fd36df27e. Report an issue: GitHub.