What causes "retrieving services for automatic port forwarding: %w" in GoogleContainerTools/skaffold?

Verify kubeconfig is valid and the kubeContext exists: kubectl config get-contexts and kubectl --context get svc

retrieving services for automatic port forwarding: %w

Error message

retrieving services for automatic port forwarding: %w

What it means

ResourceForwarder.Start optionally discovers cluster Services matching a label so their ports can be auto-forwarded. If retrieveServices fails, the error is wrapped as "retrieving services for automatic port forwarding" and Start aborts. It signals that service discovery — not the forwarding itself — failed.

Source

Thrown at pkg/skaffold/kubernetes/portforward/resource_forwarder.go:103

		var validResources []*latest.PortForwardResource
		for _, pf := range p.userDefinedResources {
			if pf.Namespace != "" {
				if err := applyWithTemplate(pf); err != nil {
					return err
				}
				validResources = append(validResources, pf)
			} else {
				log.Entry(ctx).Warnf("Skipping the port forwarding resource %s/%s because namespace is not specified", pf.Type, pf.Name)
			}
		}
		p.userDefinedResources = validResources
	}

	var serviceResources []*latest.PortForwardResource
	if p.services {
		found, err := retrieveServices(ctx, p.label, namespaces, p.kubeContext)
		if err != nil {
			return fmt.Errorf("retrieving services for automatic port forwarding: %w", err)
		}
		serviceResources = found
	}
	p.portForwardResources(ctx, append(p.userDefinedResources, serviceResources...))
	return nil
}

func applyWithTemplate(resource *latest.PortForwardResource) error {
	if resource.Namespace != "" {
		namespace, err := util.ExpandEnvTemplateOrFail(resource.Namespace, nil)
		if err != nil {
			return fmt.Errorf("cannot parse the namespace template on user defined port forwarder: %w", err)
		}
		resource.Namespace = namespace
	}
	name, err := util.ExpandEnvTemplateOrFail(resource.Name, nil)
	if err != nil {
		return fmt.Errorf("cannot parse the name template on user defined port forwarder: %w", err)

View on GitHub (pinned to a1189de023)

Solutions

Verify kubeconfig is valid and the kubeContext exists: kubectl config get-contexts and kubectl --context <ctx> get svc
Check RBAC: the user/serviceaccount needs list permission on services in the configured namespaces
Confirm network connectivity to the cluster (VPN, firewall)
If service auto-forwarding is not needed, disable the services option so Start skips discovery

Example fix

// before (skaffold.yaml)
portForward:
  - resourceType: service
// after (disable auto service discovery if RBAC is the blocker)
# remove the auto-forward config or run with a context that has list-services RBAC
# verify first:
# kubectl --context <kubeContext> auth can-i list services --namespace <ns>

Defensive patterns

Strategy: try-catch

Validate before calling

// before calling Start with services enabled:
if err := exec.Command("kubectl", "--context", kubeContext, "get", "svc").Run(); err != nil {
    return fmt.Errorf("cluster/context not usable: %w", err)
}

Try / catch

if err := forwarder.Start(ctx); err != nil {
    if strings.Contains(err.Error(), "retrieving services") {
        log.Warnf("service auto-forward unavailable: %v; continuing with user-defined forwards", err)
        return nil
    }
    return err
}

Prevention

Run `kubectl config get-contexts` and `kubectl auth can-i list services` before skaffold dev
Keep KUBECONFIG set explicitly in CI
Disable services auto-forwarding if RBAC cannot be granted

When it happens

Trigger: retrieveServices(ctx, p.label, namespaces, p.kubeContext) returns an error during Start when p.services is true; internally it fetches a Kubernetes client and lists Services per namespace.

Common situations: No kubeconfig / wrong KUBECONFIG path; unreachable or wrong kubeContext; user lacks RBAC permission to list services in the target namespaces; cluster unreachable (VPN down, wrong context after switching projects).

Related errors

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/981f389543376a83. Report an issue: GitHub.