GoogleContainerTools/skaffold · error

selecting services by label %q: %w

Error message

selecting services by label %q: %w

What it means

After obtaining a clientset, retrieveServiceResources lists Services in each namespace with the configured label selector. Any API list failure is wrapped as "selecting services by label". This is an API request failure, distinct from client-construction failure.

Source

Thrown at pkg/skaffold/kubernetes/portforward/resource_forwarder.go:187

	entry.localPort = retrieveAvailablePort(resource.Address, requestPort, &p.entryManager.forwardedPorts)
	return entry
}

// retrieveServiceResources retrieves all services in the cluster matching the given label
// as a list of PortForwardResources
func retrieveServiceResources(ctx context.Context, label string, namespaces []string, kubeContext string) ([]*latest.PortForwardResource, error) {
	client, err := kubernetesclient.Client(kubeContext)
	if err != nil {
		return nil, fmt.Errorf("getting Kubernetes client: %w", err)
	}

	var resources []*latest.PortForwardResource
	for _, ns := range namespaces {
		services, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{
			LabelSelector: label,
		})
		if err != nil {
			return nil, fmt.Errorf("selecting services by label %q: %w", label, err)
		}
		for _, s := range services.Items {
			for _, p := range s.Spec.Ports {
				resources = append(resources, &latest.PortForwardResource{
					Type:      constants.Service,
					Name:      s.Name,
					Namespace: s.Namespace,
					Port:      schemautil.FromInt(int(p.Port)),
					Address:   constants.DefaultPortForwardAddress,
				})
			}
		}
	}
	return resources, nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Test the exact query manually: kubectl get svc -n <ns> -l <label>
2. Fix RBAC with a role allowing list/get on services in the target namespaces
3. Re-authenticate to the cluster (gcloud/az/aws auth, minikube update-context)
4. Retry after confirming API server connectivity; add the label selector exists on services

Example fix

// before
services, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})
// after (verify RBAC first)
// kubectl auth can-i list services -n <ns>
// grant: kubectl create role svc-lister --verb=list,get --resource=services -n <ns>
//        kubectl create rolebinding svc-lister-binding --role=svc-lister --user=<user> -n <ns>

canList, err := exec.Command("kubectl", "auth", "can-i", "list", "services", "-n", ns).Output()
if err != nil || strings.TrimSpace(string(canList)) != "yes" {
    return fmt.Errorf("no RBAC to list services in %s", ns)
}

services, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})
if err != nil {
    if apierrors.IsForbidden(err) {
        return nil, fmt.Errorf("RBAC: grant list on services in %s", ns)
    }
    return retryWithBackoff(3, func() error {
        _, err = client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})
        return err
    })
}

When it happens

Trigger: client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label}) returns an error for any namespace — network failure, RBAC denial, expired credentials, or timeout during Start's service discovery.

Common situations: Service account lacks list-services RBAC in the namespace; token expired (cloud clusters need re-auth); API server temporarily unreachable; namespace name typo (can also yield forbidden on restricted namespaces).

Related errors

• patching resource %s/%q: %w
• patching resource %q: %w
• getting pods for namespace %q: %w
• unable to inspect the nodes: %w
• listing pods: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/d822c7a5a60975af. Report an issue: GitHub.