{"record":{"id":"9ca83ea9a917ea21","repo":"kubernetes/kops","slug":"listing-namespaces-w","errorCode":null,"errorMessage":"listing namespaces: %w","messagePattern":"listing namespaces: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/dump/resourcedumper.go","lineNumber":105,"sourceCode":"\t}\n\treturn &resourceDumper{\n\t\tk8sConfig:     k8sConfig,\n\t\tdynamicClient: dynamicClient,\n\t\toutput:        output,\n\t\tartifactsDir:  artifactsDir,\n\t}, nil\n}\n\nfunc (d *resourceDumper) DumpResources(ctx context.Context) error {\n\tklog.Info(\"Dumping k8s resources\")\n\tclientSet, err := kubernetes.NewForConfig(d.k8sConfig)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"creating clientset: %w\", err)\n\t}\n\n\tnamespaces, err := clientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing namespaces: %w\", err)\n\t}\n\n\tdiscoveryClient, err := discovery.NewDiscoveryClientForConfig(d.k8sConfig)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"creating discovery client: %w\", err)\n\t}\n\n\tresourceLists, err := discoveryClient.ServerPreferredResources()\n\tvar discoveryErr *discovery.ErrGroupDiscoveryFailed\n\tif errors.As(err, &discoveryErr) {\n\t\tklog.Warningf(\"using incomplete list of API groups: %v\", discoveryErr)\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"listing server preferred resources: %w\", err)\n\t}\n\n\tgvrNamespaces, err := getGVRNamespaces(resourceLists, namespaces.Items)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting GVR namespaces: %w\", err)","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/dump/resourcedumper.go#L87-L123","documentation":"DumpResources lists all cluster namespaces via the typed clientset (CoreV1().Namespaces().List) as its first API call, and wraps any failure with \"listing namespaces: %w\". The wrapped error is the raw client-go error (connection failure, timeout, or API StatusError such as 401/403). It is fatal for the dump because the namespace list is required to enumerate namespaced GVRs.","triggerScenarios":"The k8sConfig points at an unreachable API server, credentials are rejected (401), the user lacks permission to list namespaces at cluster scope (403), or the context is cancelled/times out during the List call.","commonSituations":"Wrong --kubeconfig or stale KUBECONFIG context; kops export with an API server endpoint that has changed (ELB gone after cluster teardown); RBAC user without cluster-level 'list namespaces'; VPN not connected; API server security group blocks the caller.","solutions":["Verify connectivity to the API server (kubectl get namespaces) and fix kubeconfig/context or network (VPN, security groups).","Check credentials are valid and current (kubectl auth whoami / re-run kops export kubecfg).","Grant the identity RBAC to list namespaces: clusterrole with 'namespaces' resource, 'list'/'get' verbs via clusterrolebinding.","Retry after transient network issues; ensure the context deadline is not too short."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cfg, err := clientcmd.BuildConfigFromFlags(\"\", kubeconfigPath)\nif err != nil { return err }\nclient, err := kubernetes.NewForConfig(cfg)\nif err != nil { return err }\nif _, err := client.Discovery().ServerVersion(); err != nil {\n\treturn fmt.Errorf(\"API server unreachable: %w\", err)\n}\nrules, err := client.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx,\n\t&authv1.SelfSubjectAccessReview{\n\t\tSpec: authv1.SelfSubjectAccessReviewSpec{\n\t\t\tResourceAttributes: &authv1.ResourceAttributes{\n\t\t\t\tVerb: \"list\", Resource: \"namespaces\",\n\t\t\t},\n\t\t},\n\t}, metav1.CreateOptions{})\nif err != nil || !rules.Status.Allowed {\n\treturn fmt.Errorf(\"identity cannot list namespaces: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := dumper.DumpResources(ctx); err != nil {\n\tif k8sErrors.IsForbidden(err) || k8sErrors.IsUnauthorized(err) {\n\t\t// fix kubeconfig / RBAC before retrying\n\t} else if apierrors.IsTimeout(err) || k8sErrors.IsServerTimeout(err) {\n\t\t// transient: retry with backoff\n\t}\n\treturn err\n}","preventionTips":["Run `kubectl get namespaces` with the same kubeconfig before invoking the dumper.","Regenerate kubecfg via `kops export kubecfg` after cluster endpoint/CA changes.","Keep VPN/security-group access to the API server verified in CI prerequisites.","Pass a context with a sane but non-trivial timeout for large clusters."],"tags":["kubernetes","client-go","network","rbac"],"backgroundTag":"kube-api-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}