{"record":{"id":"273f173f27149baa","repo":"probelabs/goreplay","slug":"err-error-273f17","errorCode":null,"errorMessage":"err.Error()","messagePattern":"err\\.Error\\(\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/capture/capture.go","lineNumber":297,"sourceCode":"\t\tdefer close(err)\n\t\tif e := l.Listen(ctx); err != nil {\n\t\t\terr <- e\n\t\t}\n\t}()\n\treturn err\n}\n\n// Allowed format:\n//\n//\t[namespace/]pod/[pod_name]\n//\t[namespace/]deployment/[deployment_name]\n//\t[namespace/]daemonset/[daemonset_name]\n//\t[namespace/]labelSelector/[selector]\n//\t[namespace/]fieldSelector/[selector]\nfunc k8sIPs(addr string) []string {\n\tconfig, err := rest.InClusterConfig()\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\n\t// creates the clientset\n\tclientset, err := kubernetes.NewForConfig(config)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\n\tsections := strings.Split(addr, \"/\")\n\n\tif len(sections) < 2 {\n\t\tpanic(\"Not supported k8s scheme. Allowed values: [namespace/]pod/[pod_name], [namespace/]deployment/[deployment_name], [namespace/]daemonset/[daemonset_name], [namespace/]label/[label-name]/[label-value]\")\n\t}\n\n\t// If no namespace passed, assume it is ALL\n\tswitch sections[0] {\n\tcase \"pod\", \"deployment\", \"daemonset\", \"labelSelector\", \"fieldSelector\":\n\t\tsections = append([]string{\"\"}, sections...)","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/probelabs/goreplay/blob/251e45abd242886bb64ff2b2dc98789556b56330/internal/capture/capture.go#L279-L315","documentation":"k8sIPs resolves a Kubernetes address scheme to pod IPs. It first calls rest.InClusterConfig(); when the process is not running inside a Kubernetes cluster (no service account token/CA mounted), it panics with the raw error string. This is a hard panic, not a returned error, because the library assumes k8s capture only runs in-cluster.","triggerScenarios":"Calling NewListener with a k8s address (e.g. 'default/pod/my-pod') from a process outside a cluster — local dev, CI, docker without a mounted service account, or with KUBERNETES_SERVICE_HOST unset.","commonSituations":"Testing k8s capture flags locally; running the binary in plain Docker; the service account token volume not mounted (automountServiceAccountToken: false); kubeconfig present in ~/.kube but in-cluster config not used.","solutions":["Run the process inside the cluster with a service account (token at /var/run/secrets/kubernetes.io/serviceaccount).","If running outside, use clientcmd kubeconfig loading instead of rest.InClusterConfig() before deciding the address is k8s.","Enable automountServiceAccountToken and grant RBAC get/list on pods for the service account.","Guard the call: only route addresses with a k8s scheme to k8sIPs; validate rest.InClusterConfig() error and fall back gracefully instead of panicking."],"exampleFix":"// before\nconfig, err := rest.InClusterConfig()\nif err != nil {\n\tpanic(err.Error())\n}\n// after\nconfig, err := rest.InClusterConfig()\nif err != nil {\n\treturn nil, fmt.Errorf(\"k8s capture requires in-cluster config: %w\", err)\n}","handlingStrategy":"fallback","validationCode":"func inCluster() bool {\n\t_, err := os.Stat(\"/var/run/secrets/kubernetes.io/serviceaccount/token\")\n\treturn err == nil && os.Getenv(\"KUBERNETES_SERVICE_HOST\") != \"\"\n}","typeGuard":null,"tryCatchPattern":"if inCluster() {\n\tips = k8sIPs(addr)\n} else {\n\treturn fmt.Errorf(\"k8s capture address %q requires running in-cluster (service account missing)\", addr)\n}","preventionTips":["Only use k8s address schemes when running in-cluster","Set automountServiceAccountToken: true on the capture pod","Check serviceaccount token file existence at startup","Prefer returned errors over panics for library code"],"tags":["kubernetes","panic","configuration","in-cluster","go"],"backgroundTag":"kubernetes-in-cluster-config-missing","analyzedSha":"251e45abd242886bb64ff2b2dc98789556b56330","analyzedAt":"2026-09-02T16:44:11.369Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}