failed to query if namespace exists (is cluster accessible?)

Error message

failed to query if namespace exists (is cluster accessible?): %w

What it means

Unless --force is passed, switchNamespace verifies the target namespace actually exists by querying the cluster API via namespaceExists. This error wraps a failure of that existence check itself — the tool could not determine whether the namespace exists, usually because the cluster is unreachable. The message explicitly hints 'is cluster accessible?'. Thrown at cmd/kubens/switch.go:80.

Source

Thrown at cmd/kubens/switch.go:80

	}

	f := NewNSFile(ctx)
	prev, err := f.Load()
	if err != nil {
		return "", fmt.Errorf("failed to load previous namespace from file: %w", err)
	}

	if ns == "-" {
		if prev == "" {
			return "", fmt.Errorf("No previous namespace found for current context (%s)", ctx)
		}
		ns = prev
	}

	if !force {
		ok, err := namespaceExists(kc, ns)
		if err != nil {
			return "", fmt.Errorf("failed to query if namespace exists (is cluster accessible?): %w", err)
		}
		if !ok {
			return "", fmt.Errorf("no namespace exists with name \"%s\"", ns)
		}
	}

	if err := kc.SetNamespace(ctx, ns); err != nil {
		return "", fmt.Errorf("failed to change to namespace \"%s\": %w", ns, err)
	}
	if err := kc.Save(); err != nil {
		return "", fmt.Errorf("failed to save kubeconfig file: %w", err)
	}
	if curNS != ns {
		if err := f.Save(curNS); err != nil {
			return "", fmt.Errorf("failed to save the previous namespace to file: %w", err)
		}
	}
	return ns, nil

View on GitHub (pinned to 12ad6fb22e)

Solutions

Test cluster connectivity: kubectl cluster-info or kubectl get ns — fix network/VPN if it fails
Verify the kubeconfig server URL matches the current cluster endpoint (IPs change after cluster recreation)
Refresh credentials: re-login (cloud provider auth plugin), rotate an expired client cert or token
If you intentionally want to switch without cluster verification, pass --force to kubens

Example fix

// before
kubens prod-ns            # offline: existence check fails
// after
kubens --force prod-ns    # skip cluster-side existence check (switch offline)

Defensive patterns

Strategy: retry

Validate before calling

// cheap pre-flight before the existence check
conn, err := net.DialTimeout("tcp", hostPortFromKubeconfig(kc), 5*time.Second)
if err != nil { return fmt.Errorf("cluster unreachable: %w", err) }
conn.Close()

Try / catch

ok, err := namespaceExists(kc, ns)
if err != nil {
    if isTransientNetErr(err) { // timeouts, conn refused
        time.Sleep(2 * time.Second)
        ok, err = namespaceExists(kc, ns)
    }
    if err != nil { return fmt.Errorf("cluster check failed (use --force to skip): %w", err) }
}

Prevention

Run `kubectl cluster-info` as a pre-flight before automated kubens calls
Keep VPN/bastion connections alive in scripts that switch namespaces
Use --force when switching offline is intentional
Update server URLs after cluster recreation (IP/DNS changes)

When it happens

Trigger: namespaceExists(kc, ns) returns an error: newKubernetesClientSet fails or the CoreV1 Namespaces().Get call fails with a non-NotFound error (connection refused, TLS failure, auth error, timeout, DNS failure).

Common situations: VPN disconnected; cluster behind a bastion with a stale kubectl-proxy requirement; kubeconfig server URL points to an old API endpoint; expired client certificate or token; DNS name for the cluster no longer resolves; air-gapped/offline machine.

Related errors

AI-assisted analysis of ahmetb/kubectx@12ad6fb22e (2026-09-02). Data as JSON: /api/errors/accea82601779e74. Report an issue: GitHub.