{"record":{"id":"b32c50e52bec32d4","repo":"ahmetb/kubectx","slug":"failed-to-initialize-k8s-rest-client-w-b32c50","errorCode":null,"errorMessage":"failed to initialize k8s REST client: %w","messagePattern":"failed to initialize k8s REST client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kubens/switch.go","lineNumber":109,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"failed to save kubeconfig file: %w\", err)\n\t}\n\tif curNS != ns {\n\t\tif err := f.Save(curNS); err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to save the previous namespace to file: %w\", err)\n\t\t}\n\t}\n\treturn ns, nil\n}\n\nfunc namespaceExists(kc *kubeconfig.Kubeconfig, ns string) (bool, error) {\n\t// for tests\n\tif os.Getenv(\"_MOCK_NAMESPACES\") != \"\" {\n\t\treturn ns == \"ns1\" || ns == \"ns2\", nil\n\t}\n\n\tclientset, err := newKubernetesClientSet(kc)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to initialize k8s REST client: %w\", err)\n\t}\n\n\tnamespace, err := clientset.CoreV1().Namespaces().Get(context.Background(), ns, metav1.GetOptions{})\n\tif errors2.IsNotFound(err) {\n\t\treturn false, nil\n\t}\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to query namespace %q from k8s API: %w\", ns, err)\n\t}\n\treturn namespace != nil, nil\n}\n","sourceCodeStart":91,"sourceCodeEnd":121,"githubUrl":"https://github.com/ahmetb/kubectx/blob/12ad6fb22e8c546ee2b54e7de38aa51c906832f7/cmd/kubens/switch.go#L91-L121","documentation":"namespaceExists builds a Kubernetes REST client from the kubeconfig via newKubernetesClientSet before querying the namespace. This error wraps any failure to construct that client — bad server URL, unparsable TLS material, missing client cert/key files, or invalid auth configuration. No network request has happened yet; this is a client-construction failure. Thrown at cmd/kubens/switch.go:109.","triggerScenarios":"newKubernetesClientSet(kc) errors while building clientcmd config/rest.Config: invalid server URL in the kubeconfig, certificate-authority / client-certificate / client-key files referenced but missing on disk, malformed embedded cert data, or an unusable exec/auth-provider plugin configuration.","commonSituations":"kubeconfig copied from a cluster but CA cert path is absolute on another machine; certificate files deleted or moved after kubeconfig was generated; exec credential plugin (aws eks, gke-gcloud-auth-plugin, az) not installed; corrupted base64 cert data after hand-editing.","solutions":["Run kubectl get ns with the same kubeconfig — kubectl reports the underlying client construction problem in detail","Verify referenced cert files exist: check certificate-authority, client-certificate, client-key paths in ~/.kube/config (use relative paths or copy the files)","Install/update the required exec credential plugin (e.g. gke-gcloud-auth-plugin, aws-iam-authenticator, kubelogin) if the user stanza uses exec","Regenerate the kubeconfig from your cluster provider to replace corrupted TLS/auth material"],"exampleFix":"// before\n# kubeconfig: certificate-authority: /home/alice/.minikube/ca.crt  (copied to bob's machine)\n// after\n# use embedded data or a path that exists locally\ncertificate-authority-data: <base64 of ca.crt>   # or fix the path\n","handlingStrategy":"validation","validationCode":"// validate client-construction inputs before building the clientset\nloadCfg := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(\n    clientcmd.NewDefaultClientConfigLoadingRules(), &clientcmd.ConfigOverrides{})\nif _, err := loadCfg.ClientConfig(); err != nil {\n    return fmt.Errorf(\"kubeconfig unusable for REST client: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"clientset, err := newKubernetesClientSet(kc)\nif err != nil {\n    return fmt.Errorf(\"REST client init failed; verify cert paths and exec plugins in kubeconfig: %w\", err)\n}","preventionTips":["Prefer certificate-authority-data (embedded) over file paths when copying kubeconfigs between machines","Verify exec credential plugins (aws/gke/az/login) are installed and on PATH","Run `kubectl get ns` as a smoke test — it surfaces the same client-construction errors with clearer messages","Regenerate kubeconfigs from the cluster provider after cert rotation instead of hand-editing"],"tags":["kubernetes-api","kubeconfig","tls"],"backgroundTag":"rest-client-init-failed","analyzedSha":"12ad6fb22e8c546ee2b54e7de38aa51c906832f7","analyzedAt":"2026-09-02T12:23:10.107Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T16:17:10.729Z"}