{"record":{"id":"cc8e9fba536f4e9f","repo":"GoogleContainerTools/skaffold","slug":"getting-pods-for-namespace-q-w","errorCode":null,"errorMessage":"getting pods for namespace %q: %w","messagePattern":"getting pods for namespace %q: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/hooks/container.go","lineNumber":103,"sourceCode":"\tcli        *kubectl.CLI\n\tselector   containerSelector\n\tnamespaces []string\n\tformatter  logger.Formatter\n}\n\n// run executes the lifecycle hook inside the target container\nfunc (h containerHook) run(ctx context.Context, out io.Writer) error {\n\terrs, ctx := errgroup.WithContext(ctx)\n\n\tclient, err := kubernetesclient.Client(h.cli.KubeContext)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting Kubernetes client: %w\", err)\n\t}\n\n\tfor _, ns := range h.namespaces {\n\t\tpods, err := client.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"getting pods for namespace %q: %w\", ns, err)\n\t\t}\n\n\t\tfor _, p := range pods.Items {\n\t\t\tfor _, c := range p.Spec.Containers {\n\t\t\t\tif matched, err := h.selector(p, c); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t} else if !matched {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\targs := []string{p.Name, \"--namespace\", p.Namespace, \"-c\", c.Name, \"--\"}\n\t\t\t\targs = append(args, h.cfg.Command...)\n\t\t\t\tcmd := h.cli.Command(ctx, \"exec\", args...)\n\t\t\t\ttr, tw := io.Pipe()\n\t\t\t\tcmd.Stderr = tw\n\t\t\t\tcmd.Stdout = tw\n\t\t\t\tpodName := p.Name\n\t\t\t\tcontainerName := c.Name\n\t\t\t\terrs.Go(func() error {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/hooks/container.go#L85-L121","documentation":"After obtaining a client, containerHook.run lists pods in each configured namespace with client.CoreV1().Pods(ns).List. If the API list call fails, the error is wrapped as 'getting pods for namespace %q: %w'.","triggerScenarios":"run iterating h.namespaces where a Pods List call fails — namespace doesn't exist, API server unreachable, or the caller lacks RBAC permission to list pods in that namespace.","commonSituations":"Hook configured with a namespace not present on the cluster (typo or wrong context); disconnected VPN/offline cluster; service account without 'list pods' RBAC in the namespace; cluster API server temporarily down.","solutions":["Verify the namespace exists in the target context: kubectl get ns","Check connectivity/auth: kubectl --context <ctx> -n <ns> get pods","Fix the namespaces list in the skaffold.yaml container hook (typos, wrong context)","Grant RBAC: create a rolebinding allowing 'list' on 'pods' in that namespace"],"exampleFix":"// before\nnamespaces: [\"stagging\"]  // typo\n// after\nnamespaces: [\"staging\"]","handlingStrategy":"retry","validationCode":"for _, ns := range namespaces {\n    if err := exec.Command(\"kubectl\", \"--context\", ctxName, \"get\", \"ns\", ns).Run(); err != nil {\n        return fmt.Errorf(\"namespace %q missing or inaccessible\", ns)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := hook.Run(ctx, out)\nif err != nil && strings.Contains(err.Error(), \"getting pods for namespace\") {\n    // transient API server errors: retry with backoff\n    return retry.Do(func() error { return hook.Run(ctx, out) }, retry.Attempts(3))\n}","preventionTips":["Verify namespaces exist in the target cluster before deploy","Grant RBAC list-pods permission to the deploy identity","Check cluster connectivity/VPN before running hooks"],"tags":["kubernetes","rbac","namespace","network","hooks"],"backgroundTag":"kubernetes-pod-list-forbidden","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}