crowdsecurity/crowdsec · error

while setting watch error handler for namespace=%q selector=

Error message

while setting watch error handler for namespace=%q selector=%q: %w

What it means

In Stream, registering the informer's watch error handler failed; this handler is what converts informer watch errors (e.g. Unauthorized) into a datasource restart, so without it the source cannot safely watch pods.

Source

Thrown at pkg/acquisition/modules/kubernetes/run.go:112

	inf := f.Core().V1().Pods().Informer()
	if err := inf.SetWatchErrorHandler(func(_ *cache.Reflector, watchErr error) {
		fields := log.Fields{
			"namespace": s.config.Namespace,
			"selector":  s.config.Selector,
			"error":     watchErr,
		}
		if apierrors.IsUnauthorized(watchErr) {
			s.logger.WithFields(fields).Error("kubernetes informer received Unauthorized, forcing datasource restart")
			select {
			case watchErrCh <- fmt.Errorf("kubernetes informer unauthorized for namespace=%q selector=%q unique_id=%q: %w", s.config.Namespace, s.config.Selector, s.config.UniqueId, watchErr):
			default:
			}
			cancelInformer()
			return
		}
		s.logger.WithFields(fields).Warn("kubernetes informer watch error")
	}); err != nil {
		return fmt.Errorf("while setting watch error handler for namespace=%q selector=%q: %w", s.config.Namespace, s.config.Selector, err)
	}

	// We ignore the ResourceEventHandlerRegistration returned by
	// AddEventHandler since we don't need to remove the handlers until shutdown,
	// and we will stop the entire informer at that time.
	s.logger.WithFields(log.Fields{
		"namespace": s.config.Namespace,
		"selector":  s.config.Selector,
	}).Info("adding kubernetes event handler")
	_, err = inf.AddEventHandler(cache.ResourceEventHandlerFuncs{
		AddFunc: func(obj any) {
			p := obj.(*corev1.Pod)
			s.logger.Debugf("ADD %s labels=%v", podRef(p), p.Labels)
			s.tailPod(informerCtx, p, out, &wg)
		},
		UpdateFunc: func(oldObj, newObj any) {
			oldP := oldObj.(*corev1.Pod)
			newP := newObj.(*corev1.Pod)

View on GitHub (pinned to 909b515798)

Solutions

1. Restart the datasource/crowdsec; this indicates informer lifecycle misuse
2. Report a bug if it reproduces on startup

When it happens

Trigger: Thrown at pkg/acquisition/modules/kubernetes/run.go:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/860462abec601a2b. Report an issue: GitHub.