{"record":{"id":"32298513442e973f","repo":"ahmetb/kubectx","slug":"failed-to-query-namespace-q-from-k8s-api-w","errorCode":null,"errorMessage":"failed to query namespace %q from k8s API: %w","messagePattern":"failed to query namespace %q from k8s API: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kubens/switch.go","lineNumber":117,"sourceCode":"}\n\nfunc namespaceExists(kc *kubeconfig.Kubeconfig, ns string) (bool, error) {\n\t// for tests\n\tif os.Getenv(\"_MOCK_NAMESPACES\") != \"\" {\n\t\treturn ns == \"ns1\" || ns == \"ns2\", nil\n\t}\n\n\tclientset, err := newKubernetesClientSet(kc)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to initialize k8s REST client: %w\", err)\n\t}\n\n\tnamespace, err := clientset.CoreV1().Namespaces().Get(context.Background(), ns, metav1.GetOptions{})\n\tif errors2.IsNotFound(err) {\n\t\treturn false, nil\n\t}\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to query namespace %q from k8s API: %w\", ns, err)\n\t}\n\treturn namespace != nil, nil\n}\n","sourceCodeStart":99,"sourceCodeEnd":121,"githubUrl":"https://github.com/ahmetb/kubectx/blob/12ad6fb22e8c546ee2b54e7de38aa51c906832f7/cmd/kubens/switch.go#L99-L121","documentation":"namespaceExists wraps any error other than 'not found' returned by the k8s API when querying a Namespace object via clientset.CoreV1().Namespaces().Get. It is raised to distinguish a legitimate missing namespace (returns false, nil) from a real API failure (auth, connectivity, permissions), so callers like switchNamespace fail loudly with the underlying cause preserved via %w.","triggerScenarios":"Any non-NotFound error from Namespaces().Get in namespaceExists: an invalid or unreadable kubeconfig, unreachable API server, expired/stale credentials, or RBAC denial (namespaces cannot get). Raised in namespaceExists, called by switchNamespace in cmd/kubens/switch.go:117.","commonSituations":"VPN disconnected so the cluster endpoint is unreachable; kubeconfig points to a wrong port or old cluster; service account token expired; user lacks 'get namespaces' RBAC permission on restricted clusters.","solutions":["Verify cluster connectivity: kubectl cluster-info with the same kubeconfig used by the tool.","Check credentials are fresh: re-login (e.g. kubectl oidc-login, cloud provider auth) or refresh the service-account token.","Confirm RBAC: run kubectl get namespace <ns> as the same user; ask an admin for 'get' on 'namespaces' if forbidden.","Confirm KUBECONFIG/current-context points to the intended cluster endpoint and port."],"exampleFix":"// before: proceeding without checking API access\nerr := switchNamespace(clientset, \"prod\")\n// after: pre-flight namespace check with clear diagnostics\nif exists, err := namespaceExists(clientset, \"prod\"); err != nil {\n\treturn fmt.Errorf(\"cannot switch: %w\", err)\n} else if !exists {\n\treturn fmt.Errorf(\"namespace %q does not exist\", \"prod\")\n}","handlingStrategy":"try-catch","validationCode":"// Go: verify API reachability and auth before switching\nif _, err := clientset.Discovery().ServerVersion(); err != nil {\n\treturn fmt.Errorf(\"cluster unreachable: %w\", err)\n}","typeGuard":"// Go: use apierrors to narrow the failure kind\nif apierrors.IsNotFound(err) { /* namespace absent, not an API failure */ }\nif apierrors.IsForbidden(err) { /* RBAC issue */ }","tryCatchPattern":"exists, err := namespaceExists(clientset, ns)\nif err != nil {\n\tvar apiErr *apierrors.StatusError\n\tif errors.As(err, &apiErr) && apiErr.ErrStatus.Reason == metav1.StatusReasonForbidden {\n\t\treturn fmt.Errorf(\"no permission to read namespaces: %w\", err)\n\t}\n\treturn fmt.Errorf(\"cluster query failed, check connectivity/credentials: %w\", err)\n}","preventionTips":["Run kubectl cluster-info as a pre-flight in scripts before switching namespaces.","Keep credentials refreshed (token rotation / re-login) for cloud clusters.","Grant 'get namespaces' RBAC to service accounts used by automation.","Pin KUBECONFIG per script to avoid silently querying the wrong cluster."],"tags":["kubernetes","api-server","namespace","network"],"backgroundTag":"k8s-api-request-failed","analyzedSha":"12ad6fb22e8c546ee2b54e7de38aa51c906832f7","analyzedAt":"2026-09-02T12:23:10.107Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T16:17:10.729Z"}