GoogleContainerTools/skaffold · error

getting pods for namespace %q: %w

Error message

getting pods for namespace %q: %w

What it means

The API call listing running pods in one of the target namespaces failed during sync. `client.CoreV1().Pods(ns).List` returned an error, which is wrapped with the namespace name for context. This happens before any file-copy/delete is executed on pods.

Source

Thrown at pkg/skaffold/sync/sync.go:345

	if len(files) == 0 {
		return nil
	}

	errs, ctx := errgroup.WithContext(ctx)

	client, err := kubernetesclient.Client(kubeContext)
	if err != nil {
		return fmt.Errorf("getting Kubernetes client: %w", err)
	}

	numSynced := 0
	for _, ns := range namespaces {
		pods, err := client.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{
			FieldSelector: fmt.Sprintf("status.phase=%s", v1.PodRunning),
		})

		if err != nil {
			return fmt.Errorf("getting pods for namespace %q: %w", ns, err)
		}

		if len(pods.Items) == 0 {
			log.Entry(ctx).Warnf("no running pods found in namespace %q", ns)
			continue
		}

		for _, p := range pods.Items {
			for _, c := range p.Spec.Containers {
				if c.Image != image {
					continue
				}

				cmd := cmdFn(ctx, p, c, files)
				errs.Go(func() error {
					_, err := util.RunCmdOut(ctx, cmd)
					return err
				})

View on GitHub (pinned to a1189de023)

Solutions

1. Run `kubectl get pods -n <ns>` with the same context to reproduce and see the raw error
2. Check RBAC: the identity needs pods/list in the namespace (clusterrole or rolebinding)
3. Verify network/VPN connectivity to the cluster API server
4. Retry once the API server recovers if it was a transient 5xx/timeout

Example fix

// before: role without pod list permission
kubectl auth can-i list pods -n default # -> no
// after
kubectl create rolebinding skaffold-pods --clusterrole=view --user=<user> -n default

// pre-check RBAC and reachability
allowed, _ := kubeClient.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx,
    &authv1.SelfSubjectAccessReview{Spec: authv1.SelfSubjectAccessReviewSpec{
        ResourceAttributes: &authv1.ResourceAttributes{Verb: "list", Resource: "pods", Namespace: ns}}})
if !allowed.Status.Allowed { return fmt.Errorf("no pods/list RBAC in %s", ns) }

errgroup inside Perform already retries per-namespace listing at the caller level; wrap with backoff:
err := retry.Do(func() error { _, e := client.CoreV1().Pods(ns).List(ctx, opts); return e }, retry.Attempts(3))
if err != nil && strings.Contains(err.Error(), "getting pods for namespace") {
    log.Warnf("pod listing failed for ns=%s: %v", ns, errors.Unwrap(err))
}

When it happens

Trigger: `Perform` iterates `namespaces` and calls `Pods(ns).List(ctx, metav1.ListOptions{FieldSelector: "status.phase=Running"})`; a network error, timeout, or RBAC denial produces this error.

Common situations: Cluster unreachable / VPN down; service account lacks `list pods` permission in that namespace; context points at the wrong cluster; API server temporarily unavailable.

Related errors

• patching resource %s/%q: %w
• patching resource %q: %w
• getting pods for namespace %q: %w
• unable to inspect the nodes: %w
• listing pods: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/7fcc13f248f82ca4. Report an issue: GitHub.