{"record":{"id":"ba35b72be902f8f3","repo":"derailed/k9s","slug":"access-no-api-server-connection","errorCode":null,"errorMessage":"ACCESS -- No API server connection","messagePattern":"ACCESS -- No API server connection","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/client/client.go","lineNumber":157,"sourceCode":"// ActiveNamespace returns the current namespace.\nfunc (a *APIClient) ActiveNamespace() string {\n\tif ns, err := a.CurrentNamespaceName(); err == nil {\n\t\treturn ns\n\t}\n\n\treturn BlankNamespace\n}\n\nfunc (a *APIClient) clearCache() {\n\tfor _, k := range a.cache.Keys() {\n\t\ta.cache.Remove(k)\n\t}\n}\n\n// CanI checks if user has access to a certain resource.\nfunc (a *APIClient) CanI(ns string, gvr *GVR, name string, verbs []string) (auth bool, err error) {\n\tif !a.getConnOK() {\n\t\treturn false, errors.New(\"ACCESS -- No API server connection\")\n\t}\n\tif gvr == NsGVR {\n\t\t// The name of the namespace is required to check permissions in some cases\n\t\tns = name\n\t}\n\tif IsClusterWide(ns) {\n\t\tns = BlankNamespace\n\t}\n\tif gvr == HmGVR {\n\t\t// helm stores release data in secrets\n\t\tgvr = SecGVR\n\t}\n\tkey := makeCacheKey(ns, gvr, name, verbs)\n\tif v, ok := a.cache.Get(key); ok {\n\t\tif auth, ok = v.(bool); ok {\n\t\t\treturn auth, nil\n\t\t}\n\t}","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/derailed/k9s/blob/2d3ccc6ba2ce98c3781bfc441bb3e884f072774f/internal/client/client.go#L139-L175","documentation":"Returned by APIClient.CanI (internal/client/client.go:157) when the client's connection flag connOK is false. CanI performs a SelfSubjectAccessReview to answer RBAC queries; without a live API server connection the review cannot be sent, so the method refuses before constructing the request. connOK is set by CheckConnectivity() and cleared whenever RESTConfig load, clientset creation, or a ServerVersion() probe fails.","triggerScenarios":"Calling CanI() before the initial connection succeeds, after a context switch that failed, or after the API server became unreachable (VPN drop, cluster teardown, expired token) which flipped connOK to false via CheckConnectivity.","commonSituations":"Cluster deleted or stopped while k9s was open; kubeconfig pointing at a dead endpoint; exec-credential token expired mid-session; code path that uses the API client before Connection.Init/CheckConnectivity has run.","solutions":["Run a.CheckConnectivity() (or reconnect/re-init the client) and retry only after it returns true","Verify the kubeconfig current-context and endpoint reachability (kubectl cluster-info, kubectl auth can-i --list)","If the token comes from an exec plugin or oidc-login, refresh credentials and reconnect","If the cluster is gone, exit/restart the session instead of retrying against the stale client"],"exampleFix":"// before\nauth, err := apiClient.CanI(ns, gvr, name, verbs)\n\n// after\nif !apiClient.CheckConnectivity() {\n    return fmt.Errorf(\"api server unreachable; reconnect before checking access\")\n}\nauth, err := apiClient.CanI(ns, gvr, name, verbs)","handlingStrategy":"validation","validationCode":"// before calling CanI, verify the connection latch\nif !apiClient.CheckConnectivity() {\n    return fmt.Errorf(\"skip RBAC check: no API server connection\")\n}","typeGuard":null,"tryCatchPattern":"// Go: treat as non-retryable precondition failure\nauth, err := apiClient.CanI(ns, gvr, name, verbs)\nif err != nil {\n    if strings.Contains(err.Error(), \"No API server connection\") {\n        // reconnect flow or degrade; do not spam retries\n    }\n    return err\n}","preventionTips":["Connect and run CheckConnectivity once at startup before any RBAC-dependent feature","Subscribe to connectivity state changes and disable access-gated UI/actions when connOK is false","Recreate the APIClient after failed context switches instead of reusing it"],"tags":["kubernetes","connection","rbac","clientset"],"backgroundTag":null,"analyzedSha":"2d3ccc6ba2ce98c3781bfc441bb3e884f072774f","analyzedAt":"2026-08-15T16:09:14.432Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}