{"record":{"id":"0da88775af503bf1","repo":"GoogleContainerTools/skaffold","slug":"attempting-to-watch-verify-job-in-cluster","errorCode":null,"errorMessage":"attempting to watch verify job in cluster","messagePattern":"attempting to watch verify job in cluster","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/verify/k8sjob/verify.go","lineNumber":259,"sourceCode":"\tcase execErr = <-execCh:\n\tcase <-v.timeout(timeoutDuration):\n\t\texecErr = errors.New(fmt.Sprintf(\"%q running k8s job timed out after : %v\", tc.Name, *timeoutDuration))\n\t\tv.logger.CancelJobLogger(job.Name)\n\t\tif err := k8sjobutil.ForceJobDelete(ctx, job.Name, clientset.BatchV1().Jobs(job.Namespace), &v.kubectl); err != nil {\n\t\t\texecErr = errors.Wrap(execErr, err.Error())\n\t\t}\n\t\teventV2.VerifyFailed(tc.Name, execErr)\n\t}\n\n\treturn execErr\n}\n\nfunc (v *Verifier) watchJob(ctx context.Context, clientset k8sclient.Interface, job *batchv1.Job, tc latest.VerifyTestCase) error {\n\tw, err := clientset.BatchV1().Jobs(job.Namespace).Watch(ctx,\n\t\tmetav1.ListOptions{FieldSelector: fmt.Sprintf(\"metadata.name=%s\", job.Name)})\n\tif err != nil {\n\t\teventV2.VerifyFailed(tc.Name, err)\n\t\treturn errors.Wrap(err, \"attempting to watch verify job in cluster\")\n\t}\n\tdefer w.Stop()\n\n\tw, err = clientset.CoreV1().Pods(job.Namespace).Watch(ctx,\n\t\tmetav1.ListOptions{\n\t\t\tLabelSelector: labels.Set(map[string]string{\"job-name\": job.Name}).String(),\n\t\t})\n\tif err != nil {\n\t\teventV2.VerifyFailed(tc.Name, err)\n\t\treturn errors.Wrap(err, \"attempting to watch verify pods in cluster\")\n\t}\n\tdefer w.Stop()\n\n\tvar podErr error\n\tfor event := range w.ResultChan() {\n\t\tpod, ok := event.Object.(*corev1.Pod)\n\t\tif ok {\n\t\t\tif pod.Status.Phase == corev1.PodSucceeded {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/verify/k8sjob/verify.go#L241-L277","documentation":"watchJob failed to establish a Watch on the batch/v1 Job in the cluster. If the watch API call errors, the verify test is marked failed with 'attempting to watch verify job in cluster' wrapping the kube client error.","triggerScenarios":"clientset.BatchV1().Jobs(ns).Watch(...) returns an error — RBAC denies watch on jobs, namespace doesn't exist, or API server connectivity fails, right after the job was created.","commonSituations":"ServiceAccount can create but not watch Jobs (missing 'get/watch jobs' RBAC); API server momentarily unavailable; wrong namespace context; network policies blocking watch streams.","solutions":["Verify RBAC: `kubectl auth can-i watch jobs -n <ns>` and add the missing role rules","Confirm the job/namespace exist: `kubectl get jobs -n <ns>`","Check kubeconfig/cluster connectivity and API server health","Retry `skaffold verify`; if transient, the watch usually succeeds on rerun"],"exampleFix":"// before: role without watch\nrules:\n- apiGroups: [\"batch\"]\n  resources: [\"jobs\"]\n  verbs: [\"create\"]\n// after\nrules:\n- apiGroups: [\"batch\"]\n  resources: [\"jobs\"]\n  verbs: [\"create\", \"get\", \"list\", \"watch\"]","handlingStrategy":"validation","validationCode":"// Pre-check watch permission on jobs\nif err := exec.Command(\"kubectl\", \"auth\", \"can-i\", \"watch\", \"jobs\", \"-n\", ns).Run(); err != nil {\n    return fmt.Errorf(\"serviceaccount cannot watch jobs in namespace %s\", ns)\n}","typeGuard":null,"tryCatchPattern":"if err := verifier.Verify(ctx, out, tc); err != nil {\n    if strings.Contains(err.Error(), \"attempting to watch verify job in cluster\") {\n        return fmt.Errorf(\"job watch failed (add jobs/watch RBAC): %w\", err)\n    }\n    return err\n}","preventionTips":["Include get/list/watch on batch jobs in the verify ServiceAccount role","Check API server health before long verify runs","Use a kubeconfig pointing at the intended cluster/namespace"],"tags":["kubernetes","verify","watch","rbac"],"backgroundTag":"kubernetes-watch-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}