ahmetb/kubectx · error

failed to initialize k8s REST client: %w

Error message

failed to initialize k8s REST client: %w

What it means

namespaceExists builds a Kubernetes REST client from the kubeconfig via newKubernetesClientSet before querying the namespace. This error wraps any failure to construct that client — bad server URL, unparsable TLS material, missing client cert/key files, or invalid auth configuration. No network request has happened yet; this is a client-construction failure. Thrown at cmd/kubens/switch.go:109.

Source

Thrown at cmd/kubens/switch.go:109

		return "", fmt.Errorf("failed to save kubeconfig file: %w", err)
	}
	if curNS != ns {
		if err := f.Save(curNS); err != nil {
			return "", fmt.Errorf("failed to save the previous namespace to file: %w", err)
		}
	}
	return ns, nil
}

func namespaceExists(kc *kubeconfig.Kubeconfig, ns string) (bool, error) {
	// for tests
	if os.Getenv("_MOCK_NAMESPACES") != "" {
		return ns == "ns1" || ns == "ns2", nil
	}

	clientset, err := newKubernetesClientSet(kc)
	if err != nil {
		return false, fmt.Errorf("failed to initialize k8s REST client: %w", err)
	}

	namespace, err := clientset.CoreV1().Namespaces().Get(context.Background(), ns, metav1.GetOptions{})
	if errors2.IsNotFound(err) {
		return false, nil
	}
	if err != nil {
		return false, fmt.Errorf("failed to query namespace %q from k8s API: %w", ns, err)
	}
	return namespace != nil, nil
}

View on GitHub (pinned to 12ad6fb22e)

Solutions

1. Run kubectl get ns with the same kubeconfig — kubectl reports the underlying client construction problem in detail
2. Verify referenced cert files exist: check certificate-authority, client-certificate, client-key paths in ~/.kube/config (use relative paths or copy the files)
3. Install/update the required exec credential plugin (e.g. gke-gcloud-auth-plugin, aws-iam-authenticator, kubelogin) if the user stanza uses exec
4. Regenerate the kubeconfig from your cluster provider to replace corrupted TLS/auth material

Example fix

// before
# kubeconfig: certificate-authority: /home/alice/.minikube/ca.crt  (copied to bob's machine)
// after
# use embedded data or a path that exists locally
certificate-authority-data: <base64 of ca.crt>   # or fix the path

// validate client-construction inputs before building the clientset
loadCfg := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
    clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{})
if _, err := loadCfg.ClientConfig(); err != nil {
    return fmt.Errorf("kubeconfig unusable for REST client: %w", err)
}

clientset, err := newKubernetesClientSet(kc)
if err != nil {
    return fmt.Errorf("REST client init failed; verify cert paths and exec plugins in kubeconfig: %w", err)
}

When it happens

Trigger: newKubernetesClientSet(kc) errors while building clientcmd config/rest.Config: invalid server URL in the kubeconfig, certificate-authority / client-certificate / client-key files referenced but missing on disk, malformed embedded cert data, or an unusable exec/auth-provider plugin configuration.

Common situations: kubeconfig copied from a cluster but CA cert path is absolute on another machine; certificate files deleted or moved after kubeconfig was generated; exec credential plugin (aws eks, gke-gcloud-auth-plugin, az) not installed; corrupted base64 cert data after hand-editing.

Related errors

• failed to create transport: %w
• kubeconfig error: %w
• failed to get current context: %w
• failed to read namespace of "%s": %w
• kubeconfig error: %w

AI-assisted analysis of ahmetb/kubectx@12ad6fb22e (2026-09-02). Data as JSON: /api/errors/b32c50e52bec32d4. Report an issue: GitHub.