{"record":{"id":"9bbd0ff028875b7d","repo":"kubernetes/kops","slug":"error-listing-pods-v-9bbd0f","errorCode":null,"errorMessage":"error listing Pods: %v","messagePattern":"error listing Pods: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/validation/validate_cluster.go","lineNumber":330,"sourceCode":"\t\tvar notready []string\n\t\tfor _, container := range pod.Status.ContainerStatuses {\n\t\t\tif !container.Ready {\n\t\t\t\tnotready = append(notready, container.Name)\n\t\t\t\tlog.V(2).Info(\"container not ready\", \"pod\", pod.Name, \"container\", container.Name, \"state\", container.State)\n\t\t\t}\n\t\t}\n\t\tif len(notready) != 0 {\n\t\t\tv.addError(&ValidationError{\n\t\t\t\tKind:          \"Pod\",\n\t\t\t\tName:          pod.Namespace + \"/\" + pod.Name,\n\t\t\t\tMessage:       fmt.Sprintf(\"%s pod %q is not ready (%s)\", priority, pod.Name, strings.Join(notready, \",\")),\n\t\t\t\tInstanceGroup: podNode,\n\t\t\t})\n\t\t}\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error listing Pods: %v\", err)\n\t}\n\n\tfor node, nodeMap := range masterWithoutPod {\n\t\tfor app := range nodeMap {\n\t\t\tv.addError(&ValidationError{\n\t\t\t\tKind:          \"Node\",\n\t\t\t\tName:          node,\n\t\t\t\tMessage:       fmt.Sprintf(\"control-plane node %q is missing %s pod\", node, app),\n\t\t\t\tInstanceGroup: nodeInstanceGroupMapping[node],\n\t\t\t})\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (v *ValidationCluster) validateNodes(cloudGroups map[string]*cloudinstances.CloudInstanceGroup, groups []*kops.InstanceGroup, shouldValidateInstanceGroup func(ig *kops.InstanceGroup) bool, toleratedNodes map[string]bool) ([]v1.Node, map[string]*kops.InstanceGroup) {\n\tvar readyNodes []v1.Node","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/validation/validate_cluster.go#L312-L348","documentation":"collectPodFailures lists Pods (in the loop whose error is aggregated by the errgroup-style construct) to determine master static pod and general pod health. A failed list is wrapped as \"error listing Pods\". Because pod presence is part of validation, a list failure aborts the pod-health phase.","triggerScenarios":"The Kubernetes pod list call inside collectPodFailures returns an error — RBAC denial, namespace not found, API server unreachable, or context cancellation — which is returned by the run-group and wrapped here.","commonSituations":"Validating with a kubeconfig user lacking list pods permission; API server flapping during rolling update; private API endpoint validated from outside the network; deleted/recreated namespaces mid-validation.","solutions":["Run kubectl get pods -A (or in kube-system) to reproduce the underlying error","Fix RBAC for the validating identity to list pods cluster-wide","Restore API reachability (VPN/VPC) and re-run validation","Retry after transient API errors; verify the cluster context in kubeconfig matches the target cluster"],"exampleFix":"// before\n$ kops validate cluster\n# error listing Pods: pods is forbidden: User \"ci\" cannot list resource \"pods\" ...\n// after\n$ kubectl create clusterrolebinding ci-pods --clusterrole=system:node --user=ci  # or use an admin-capable identity\n$ kops validate cluster","handlingStrategy":"retry","validationCode":"_, err := k8sClient.CoreV1().Pods(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})\nif err != nil {\n    return fmt.Errorf(\"pod list precondition failed: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"err := wait.PollImmediate(5*time.Second, time.Minute, func() (bool, error) {\n    _, err := k8sClient.CoreV1().Pods(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})\n    return err == nil, nil\n})\nif err != nil {\n    return fmt.Errorf(\"pods remained unlistable: %w\", err)\n}","preventionTips":["Ensure cluster-wide pod list RBAC for the validator identity","Avoid deleting/recreating namespaces during validation","Run from a network position that can reach the API server for the whole validation window"],"tags":["go","kubernetes","pods","rbac","kops"],"backgroundTag":"kubernetes-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}