GoogleContainerTools/skaffold · error

unable to inspect the nodes: %w

Error message

unable to inspect the nodes: %w

What it means

findKnownImages queries all cluster nodes with `kubectl get nodes -ojsonpath={@.items[*].status.images[*].names[*]}` to build the list of images the nodes already hold. This error wraps any failure of that kubectl invocation — API server unreachable, authentication/authorization failure, or kubectl configuration problems.

Source

Thrown at pkg/skaffold/kubernetes/loader/load.go:173

		}

		cmd := createCmd(artifact.Tag)
		if cmdOut, err := util.RunCmdOut(ctx, cmd); err != nil {
			output.Red.Fprintln(out, "Failed")
			return fmt.Errorf("unable to load image %q into cluster: %w, %s", artifact.Tag, err, cmdOut)
		}

		output.Green.Fprintln(out, "Loaded")
	}

	output.Default.Fprintln(out, "Images loaded in", timeutil.Humanize(time.Since(start)))
	return nil
}

func findKnownImages(ctx context.Context, cli *kubectl.CLI) ([]string, error) {
	nodeGetOut, err := cli.RunOut(ctx, "get", "nodes", `-ojsonpath={@.items[*].status.images[*].names[*]}`)
	if err != nil {
		return nil, fmt.Errorf("unable to inspect the nodes: %w", err)
	}

	knownImages := strings.Split(string(nodeGetOut), " ")
	return knownImages, nil
}

func (i *ImageLoader) getCurrentContext() (*api.Context, error) {
	currentCfg, err := kubectx.CurrentConfig()
	if err != nil {
		return nil, fmt.Errorf("unable to get kubernetes config: %w", err)
	}

	currentContext, present := currentCfg.Contexts[i.kubeContext]
	if !present {
		return nil, fmt.Errorf("unable to get current kubernetes context: %w", err)
	}
	return currentContext, nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Reproduce with `kubectl get nodes` using the same context; the wrapped error identifies the root cause
2. Refresh credentials (e.g. `gcloud container clusters get-credentials`, re-login, or regenerate kubeconfig)
3. Check RBAC: `kubectl auth can-i get nodes` — use a context/user with node read access
4. Verify connectivity to the API server (endpoint, proxy, VPN) in kubeconfig's cluster server URL
5. If the cluster was recreated, update the kubeconfig to the new endpoint/certificate

Example fix

// before: stale credentials
$ kubectl get nodes  # Unauthorized
// after: refresh and retry
$ gcloud container clusters get-credentials mycluster --region us-central1
$ skaffold dev

// Pre-flight: can this context list nodes?
if err := exec.Command("kubectl", "auth", "can-i", "get", "nodes").Run(); err != nil {
    return fmt.Errorf("context lacks node read permission; findKnownImages will fail")
}

known, err := k8sloader.FindKnownImages(ctx, cli)
if err != nil && strings.Contains(err.Error(), "unable to inspect the nodes") {
    log.Warnf("skipping known-image optimization, forcing full load: %v", err)
    known = nil // proceed with unconditional load
}

When it happens

Trigger: The first image being loaded into a kind/k3d cluster triggers findKnownImages (knownImages is nil); the kubectl get nodes call fails because the context is invalid, the API server is down, or the user lacks node list permission.

Common situations: Expired/missing credentials in kubeconfig; API server endpoint changed (cluster recreated with same context name); RBAC-restricted service account; kubectl version too old for the cluster; network/firewall blocking the API server port.

Related errors

• unable to retrieve node's images: %w
• getting remote manifests: %w
• kubectl delete: %w
• kubectl apply: %w
• %d resources failed to complete their deletion before a new

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/a5bbff8ff9d8d21b. Report an issue: GitHub.