GoogleContainerTools/skaffold · error

STATUSCHECK_DEPLOYMENT_FETCH_ERR

STATUSCHECK_DEPLOYMENT_FETCH_ERR

Error message

could not fetch deployments: %w

What it means

Skaffold's status check wraps every error from listing Kubernetes Deployments in a namespace with this message before returning STATUSCHECK_DEPLOYMENT_FETCH_ERR. The underlying error comes from the typed client call client.AppsV1().Deployments(ns).List(...) (via getDeployments), so any API-server, RBAC, namespace, or network failure surfaces here.

Source

Thrown at pkg/skaffold/kubernetes/status/status_check.go:184

func (s *monitor) Reset() {
	s.seenResources.Reset()
}

func (s *monitor) statusCheck(ctx context.Context, out io.Writer) (proto.StatusCode, error) {
	client, err := kubernetesclient.Client(s.kubeContext)
	if err != nil {
		return proto.StatusCode_STATUSCHECK_KUBECTL_CLIENT_FETCH_ERR, fmt.Errorf("getting Kubernetes client: %w", err)
	}
	dynClient, err := kubernetesclient.DynamicClient(s.kubeContext)
	if err != nil {
		return proto.StatusCode_STATUSCHECK_KUBECTL_CLIENT_FETCH_ERR, fmt.Errorf("getting Kubernetes client: %w", err)
	}
	resources := make([]*resource.Resource, 0)
	for _, n := range *s.namespaces {
		newDeployments, err := getDeployments(ctx, client, n, s.labeller, getDeadline(s.deadlineSeconds), s.tolerateFailures)
		if err != nil {
			return proto.StatusCode_STATUSCHECK_DEPLOYMENT_FETCH_ERR, fmt.Errorf("could not fetch deployments: %w", err)
		}
		for _, d := range newDeployments {
			if s.seenResources.Contains(d) {
				continue
			}
			resources = append(resources, d)
			s.seenResources.Add(d)
		}

		newStatefulSets, err := getStatefulSets(ctx, client, n, s.labeller, getDeadline(s.deadlineSeconds), s.tolerateFailures)
		if err != nil {
			return proto.StatusCode_STATUSCHECK_STATEFULSET_FETCH_ERR, fmt.Errorf("could not fetch statefulsets: %w", err)
		}
		for _, d := range newStatefulSets {
			if s.seenResources.Contains(d) {
				continue
			}
			resources = append(resources, d)

View on GitHub (pinned to a1189de023)

Solutions

1. Run 'kubectl auth can-i list deployments.apps -n <ns>' with the same kubeconfig to verify RBAC
2. Verify the cluster context and namespace: 'kubectl config current-context' and 'kubectl get ns <ns>'
3. Check connectivity to the API server: 'kubectl get deployments -n <ns>' directly
4. If RBAC is the issue, bind a ClusterRole with get/list/watch on deployments.apps to the user/service account
5. Re-run skaffold once the cluster/network is reachable — the status check is retryable

Example fix

// before: no RBAC for deployments
//   kubectl create rolebinding dev --clusterrole=view --user=dev -n app  # view lacks nothing here, but custom roles often do
// after: grant explicit deployment list access
//   kubectl create clusterrole skaffold-status --verb=get,list,watch --resource=deployments.apps
//   kubectl create rolebinding skaffold-status --clusterrole=skaffold-status --user=dev

kubectl auth can-i list deployments.apps -n <ns> # must print yes before running

func IsDeploymentFetchErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "could not fetch deployments")
}

if err := runStatusCheck(ctx); err != nil {
	if IsDeploymentFetchErr(err) {
		var se *apierrors.StatusError
		if errors.As(err, &se) && apierrors.IsForbidden(err) {
			// fix RBAC
		}
		return fmt.Errorf("status check aborted: %w", err)
	}
	return err
}

When it happens

Trigger: getDeployments fails on client.AppsV1().Deployments(ns).List with a label selector l.RunIDSelector(): API server unreachable, RBAC denies list deployments, namespace does not exist, context/cluster misconfigured, or network timeout before the deadline.

Common situations: Wrong kubectl context (pointing at a cluster where the run-id labeled deployments don't exist or access is denied); user lacks 'list deployments' in the namespace; namespace typo; VPN/proxy down; expired credentials (e.g. GKE token); API server briefly unavailable during deploy.

Related errors

• could not fetch deployments: %w
• patching resource %s/%q: %w
• getting server resources for group version: %w
• getting pods for namespace %q: %w
• listing pods: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/556f55f552f5fad0. Report an issue: GitHub.