{"record":{"id":"cadca3d4586258b4","repo":"lima-vm/lima","slug":"failed-to-run-v-expected-yes-got-q","errorCode":null,"errorMessage":"failed to run %v: expected `yes`, got %#q","messagePattern":"failed to run (.+?): expected `yes`, got %#q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/kubernetesservice/kubernetesservice.go","lineNumber":121,"sourceCode":"\t\t\treturn kc\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc canGetServices(ctx context.Context, kubectl, kubeconfig string) error {\n\tcmd := exec.CommandContext(ctx, kubectl, \"auth\", \"can-i\", \"get\", \"service\")\n\tif kubeconfig != \"\" {\n\t\tcmd.Env = append(os.Environ(), \"KUBECONFIG=\"+kubeconfig)\n\t}\n\tvar stdout, stderr bytes.Buffer\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\tif err := cmd.Run(); err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w; stdout=%#q, stderr=%#q\", cmd.Args, err, stdout.String(), stderr.String())\n\t}\n\tif strings.TrimSpace(stdout.String()) != \"yes\" {\n\t\treturn fmt.Errorf(\"failed to run %v: expected `yes`, got %#q\", cmd.Args, stdout.String())\n\t}\n\treturn nil\n}\n\nfunc (s *ServiceWatcher) startAndStreamKubectl(cmd *exec.Cmd) error {\n\tstdout, err := cmd.StdoutPipe()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar stderr bytes.Buffer\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Start(); err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w; stderr=%#q\", cmd.Args, err, stderr.String())\n\t}\n\n\treadErr := s.readKubectlStream(stdout)","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/kubernetesservice/kubernetesservice.go#L103-L139","documentation":"After canGetServices' kubectl probe exits successfully, its stdout must equal `yes` (after trimming whitespace); anything else throws this error. This is the library's way of validating that the probe actually reported service accessibility, not just that kubectl exited cleanly.","triggerScenarios":"The kubectl probe command exits 0 but prints something other than `yes`: kubectl prints warnings or help text, the wrong subcommand is invoked, a plugin intercepts output, or the cluster answers but the probe logic returns no/false unexpectedly.","commonSituations":"Kubectl version mismatch altering output format; server reachable but authorization denied while kubectl still exits 0 with an API error message; kubectl output polluted by warnings (e.g. deprecation notices) on stdout.","solutions":["Inspect the got=... value in the message to see what kubectl actually printed.","Run the same kubectl command manually in the guest and compare output.","Align kubectl client version with the cluster server version.","Silence kubectl warnings (e.g. --warnings-as-errors=false handling or redirect warnings to stderr) so stdout contains only the expected `yes`."],"exampleFix":"// before (output includes warnings)\nexpected `yes`, got \"Warning: v1 Endpoints...\\nno\"\n// after\nkubectl ... 2>/dev/null | tail -n1  # ensure only the verdict reaches stdout","handlingStrategy":"try-catch","validationCode":"out, err := exec.Command(\"kubectl\", \"--kubeconfig\", kubeconfig, \"auth\", \"can-i\", \"get\", \"services\").Output()\nif err == nil && strings.TrimSpace(string(out)) != \"yes\" {\n    return fmt.Errorf(\"RBAC denies service listing; kubectl will answer %q\", strings.TrimSpace(string(out)))\n}","typeGuard":null,"tryCatchPattern":"if err := canGetServices(ctx, kubeconfig); err != nil {\n    if strings.Contains(err.Error(), \"expected `yes`\") {\n        // inspect got=... in the message; usually RBAC denial or polluted stdout\n    }\n}","preventionTips":["Grant the kubeconfig identity RBAC permission to list services (`auth can-i get services`).","Pin kubectl client version to match the cluster server version.","Ensure nothing adds warnings or extra text to kubectl's stdout."],"tags":["kubernetes","kubectl","guestagent","output-validation"],"backgroundTag":"unexpected-command-output","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}