{"record":{"id":"cdda121abb01aa1a","repo":"kubernetes/kops","slug":"listing-server-preferred-resources-w","errorCode":null,"errorMessage":"listing server preferred resources: %w","messagePattern":"listing server preferred resources: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/dump/resourcedumper.go","lineNumber":118,"sourceCode":"\t\treturn fmt.Errorf(\"creating clientset: %w\", err)\n\t}\n\n\tnamespaces, err := clientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing namespaces: %w\", err)\n\t}\n\n\tdiscoveryClient, err := discovery.NewDiscoveryClientForConfig(d.k8sConfig)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"creating discovery client: %w\", err)\n\t}\n\n\tresourceLists, err := discoveryClient.ServerPreferredResources()\n\tvar discoveryErr *discovery.ErrGroupDiscoveryFailed\n\tif errors.As(err, &discoveryErr) {\n\t\tklog.Warningf(\"using incomplete list of API groups: %v\", discoveryErr)\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"listing server preferred resources: %w\", err)\n\t}\n\n\tgvrNamespaces, err := getGVRNamespaces(resourceLists, namespaces.Items)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting GVR namespaces: %w\", err)\n\t}\n\n\tjobs := make(chan gvrNamespace, len(gvrNamespaces))\n\tresults := make(chan resourceDumpResult, len(gvrNamespaces))\n\n\tfor i := 0; i < resourceDumpConcurrency; i++ {\n\t\tgo d.dumpGVRNamespaces(ctx, jobs, results)\n\t}\n\n\tvar dumpErr error\n\n\tfor _, gvrn := range gvrNamespaces {\n\t\tjobs <- gvrn","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/dump/resourcedumper.go#L100-L136","documentation":"The discovery client's ServerPreferredResources() call is wrapped with \"listing server preferred resources: %w\", but only when the error is NOT a *discovery.ErrGroupDiscoveryFailed. Partial group-discovery failures are tolerated (logged as a warning) because the dump can proceed with the groups it did discover; total failure (network, auth, no reachable server) returns this error.","triggerScenarios":"The /apis and /api discovery endpoints are entirely unreachable or rejected: connection failure, 401/403, context cancellation, or a server that cannot serve discovery at all. Aggregated-apiserver outages alone produce ErrGroupDiscoveryFailed, which is NOT this error.","commonSituations":"API server briefly down mid-dump; RBAC identity can list namespaces but cannot hit discovery endpoints; heavily aggregated clusters where a non-ErrGroupDiscoveryFailed error surfaces; TLS intercepting proxies breaking the discovery response.","solutions":["Check API server health (kubectl get --raw /apis) and network path.","Re-check auth: kubectl auth can-i get --all and ensure the discovery API is permitted.","Retry the dump; discovery is a single GET pair and transient outages resolve it.","If ErrGroupDiscoveryFailed is logged instead, address the failing group's aggregated API server (install/fix the CRD or aggregation layer)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"disc, err := discovery.NewDiscoveryClientForConfig(cfg)\nif err != nil { return err }\nif _, err := disc.ServerVersion(); err != nil {\n\treturn fmt.Errorf(\"discovery endpoint unreachable: %w\", err)\n}","typeGuard":"func isPartialDiscoveryFailed(err error) bool {\n\tvar gdf *discovery.ErrGroupDiscoveryFailed\n\t// partial failure is tolerated by DumpResources; only total failure returns\n\treturn errors.As(err, &gdf)\n}","tryCatchPattern":"if err := dumper.DumpResources(ctx); err != nil {\n\tif k8sErrors.IsUnauthorized(err) || k8sErrors.IsForbidden(err) {\n\t\t// auth problem on discovery endpoints — fix credentials/RBAC\n\t} else if strings.Contains(err.Error(), \"listing server preferred resources\") {\n\t\t// total discovery failure: check apiserver health, then retry\n\t}\n\treturn err\n}","preventionTips":["Verify `kubectl get --raw /apis` succeeds with the same credentials before dumping.","Treat klog warnings about incomplete API groups as early signals of aggregated-apiserver problems.","Keep aggregated API servers and CRDs healthy so discovery doesn't degrade.","Retry total discovery failures with backoff; they are usually transient."],"tags":["kubernetes","client-go","discovery","network"],"backgroundTag":"api-discovery-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}