{"record":{"id":"0a31f8244fb33a2b","repo":"kubernetes/kops","slug":"error-listing-objects-w","errorCode":null,"errorMessage":"error listing objects: %w","messagePattern":"error listing objects: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"channels/pkg/channels/prune.go","lineNumber":96,"sourceCode":"func (p *Pruner) pruneObjectsOfKind(ctx context.Context, gk schema.GroupKind, spec *api.PruneKindSpec, keepObjects []*kubemanifest.Object) error {\n\tklog.Infof(\"pruning objects of kind: %v\", gk)\n\n\trestMapping, err := p.RESTMapper.RESTMapping(gk)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to find resource for %s: %w\", gk, err)\n\t}\n\n\tgvr := restMapping.Resource\n\n\tvar listOptions v1.ListOptions\n\tlistOptions.LabelSelector = spec.LabelSelector\n\tlistOptions.FieldSelector = spec.FieldSelector\n\n\tbaseResource := p.Client.Resource(gvr)\n\tif len(spec.Namespaces) == 0 {\n\t\tobjects, err := baseResource.List(ctx, listOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error listing objects: %w\", err)\n\t\t}\n\t\tif err := p.pruneObjects(ctx, gvr, objects, keepObjects); err != nil {\n\t\t\treturn err\n\t\t}\n\t} else {\n\t\tfor _, namespace := range spec.Namespaces {\n\t\t\tresource := baseResource.Namespace(namespace)\n\t\t\tactualObjects, err := resource.List(ctx, listOptions)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error listing objects in namespace %s: %w\", namespace, err)\n\t\t\t}\n\t\t\tif err := p.pruneObjects(ctx, gvr, actualObjects, keepObjects); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/channels/pkg/channels/prune.go#L78-L114","documentation":"While pruning objects of a GroupKind, the Pruner's LIST call against the Kubernetes API failed. The REST mapping succeeded, so this is a runtime API error (permissions, connectivity, or an invalid selector), wrapped with 'error listing objects'.","triggerScenarios":"Cluster-scoped prune path: dynamic client List with labelSelector/fieldSelector fails — forbidden by RBAC, invalid label/field selector syntax, API server unreachable, or the resource does not support the requested field selector.","commonSituations":"Service account lacking list permission on the resource cluster-wide; typo in labelSelector (e.g. unmatched quotes); field selector not supported by the resource (e.g. custom resources with limited field selectors); network/VPN down.","solutions":["Read the wrapped error: 403 → fix RBAC; 400 → fix selector syntax; connection error → fix cluster access","Test the selector manually: `kubectl get <resource> -l <labelSelector> --all-namespaces`","Grant the kops service account list/get on the pruned group/resource","Remove unsupported fieldSelectors from the PruneKindSpec"],"exampleFix":"// before\nlistOptions.FieldSelector = \"spec.someUnknownField=abc\" // unsupported by CR\n// after\nlistOptions.LabelSelector = \"app=myapp\" // use a supported label selector","handlingStrategy":"try-catch","validationCode":"// pre-check list permission cluster-wide\nok, err := authClient.SelfSubjectAccessReviews().Create(ctx, &authorizationv1.SelfSubjectAccessReview{\n    Spec: authorizationv1.SelfSubjectAccessReviewSpec{\n        ResourceAttributes: &authorizationv1.ResourceAttributes{\n            Verb: \"list\", Group: gk.Group, Resource: resourceName}},\n})\nif err != nil || !ok.Status.Allowed {\n    return fmt.Errorf(\"RBAC denies list on %s\", resourceName)\n}","typeGuard":null,"tryCatchPattern":"if err := pruner.Prune(ctx, manifest, spec); err != nil {\n    if strings.Contains(err.Error(), \"error listing objects\") {\n        apiStatus := statusFromErr(errors.Unwrap(err)) // check codes 403/400\n        return fmt.Errorf(\"prune list failed (%v); fix RBAC/selectors\", apiStatus)\n    }\n    return err\n}","preventionTips":["Grant the kops identity list/get on all pruned groups cluster-wide","Validate labelSelector/fieldSelector syntax before publishing prune specs","Confirm cluster connectivity (kubectl get --raw /healthz) before updates"],"tags":["list","dynamic-client","rbac","kubernetes"],"backgroundTag":"list-objects-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}