{"record":{"id":"35c62f843bc89afb","repo":"GoogleContainerTools/skaffold","slug":"unable-to-connect-to-kubernetes-w-35c62f","errorCode":null,"errorMessage":"unable to connect to Kubernetes: %w","messagePattern":"unable to connect to Kubernetes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/skaffold/deploy/kubectl/kubectl.go","lineNumber":211,"sourceCode":"\n// Deploy templates the provided manifests with a simple `find and replace` and\n// runs `kubectl apply` on those manifests\nfunc (k *Deployer) Deploy(ctx context.Context, out io.Writer, builds []graph.Artifact, manifestsByConfig manifest.ManifestListByConfig) error {\n\tmanifests := manifestsByConfig.GetForConfig(k.ConfigName())\n\tvar (\n\t\terr      error\n\t\tchildCtx context.Context\n\t\tendTrace func(...trace.SpanEndOption)\n\t)\n\tinstrumentation.AddAttributesToCurrentSpanFromContext(ctx, map[string]string{\n\t\t\"DeployerType\": \"kubectl\",\n\t})\n\n\t// Check that the cluster is reachable.\n\t// This gives a better error message when the cluster can't\n\t// be reached.\n\tif err := kubernetes.FailIfClusterIsNotReachable(k.kubectl.KubeContext); err != nil {\n\t\treturn fmt.Errorf(\"unable to connect to Kubernetes: %w\", err)\n\t}\n\n\t// if any hydrated manifests are passed to `skaffold apply`, only deploy these\n\t// also, manually set the labels to ensure the runID is added\n\tif len(k.hydratedManifests) > 0 {\n\t\t_, endTrace = instrumentation.StartTrace(ctx, \"Deploy_readHydratedManifests\")\n\t\tmanifests, err = k.kubectl.ReadManifests(ctx, k.hydratedManifests)\n\t\tif err != nil {\n\t\t\tendTrace(instrumentation.TraceEndError(err))\n\t\t\treturn err\n\t\t}\n\t\tmanifests, err = manifests.SetLabels(k.labeller.Labels(), manifest.NewResourceSelectorLabels(k.transformableAllowlist, k.transformableDenylist))\n\t\tendTrace()\n\t}\n\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/deploy/kubectl/kubectl.go#L193-L229","documentation":"Before deploying, the kubectl deployer proactively checks cluster reachability via kubernetes.FailIfClusterIsNotReachable to produce a clearer message than a failed apply. If the API server cannot be contacted (DNS, network, auth, or kubeconfig issues), the underlying error is wrapped as 'unable to connect to Kubernetes'.","triggerScenarios":"FailIfClusterIsNotReachable(k.kubectl.KubeContext) returns an error during Deploy — API server endpoint unreachable, kubeconfig context invalid, VPN off, or expired credentials making a probe request fail.","commonSituations":"Working remotely without VPN; minikube/kind cluster stopped; context switched to a deleted GKE/EKS cluster; KUBECONFIG env var pointing to wrong file; clock skew invalidating tokens.","solutions":["Verify with `kubectl cluster-info` (same context) and start the cluster/VPN if unreachable.","Check the current context: `kubectl config current-context`, and switch/correct it or the KUBECONFIG path.","Re-authenticate (gcloud/aws/az credentials) if the probe error indicates auth.","For minikube/kind: `minikube start` or `kind create cluster` before deploying."],"exampleFix":"// before\n$ skaffold deploy\nunable to connect to Kubernetes: ... dial tcp: lookup nonexistent.cluster\n// after\nkubectl config use-context my-cluster\nkubectl cluster-info\n$ skaffold deploy","handlingStrategy":"validation","validationCode":"// Preflight: cluster must be reachable before invoking deploy\nif err := exec.Command(\"kubectl\", \"cluster-info\").Run(); err != nil {\n    return fmt.Errorf(\"predeploy check failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := deploy(ctx, out, artifacts); err != nil {\n    if strings.Contains(err.Error(), \"unable to connect to Kubernetes\") {\n        log.Errorf(\"check VPN/cluster status and kubeconfig context: %v\", err)\n    }\n    return err\n}","preventionTips":["Add a `kubectl cluster-info` preflight gate to CI/CD pipelines","Start local clusters (minikube/kind) before deploying","Connect VPN before remote cluster operations","Verify current-context and KUBECONFIG point at the intended cluster","Rotate cloud credentials on a schedule to avoid expiry mid-deploy"],"tags":["kubernetes","connectivity","kubectl","kubeconfig"],"backgroundTag":"connection-refused","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}