{"record":{"id":"d822c7a5a60975af","repo":"GoogleContainerTools/skaffold","slug":"selecting-services-by-label-q-w","errorCode":null,"errorMessage":"selecting services by label %q: %w","messagePattern":"selecting services by label %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/kubernetes/portforward/resource_forwarder.go","lineNumber":187,"sourceCode":"\tentry.localPort = retrieveAvailablePort(resource.Address, requestPort, &p.entryManager.forwardedPorts)\n\treturn entry\n}\n\n// retrieveServiceResources retrieves all services in the cluster matching the given label\n// as a list of PortForwardResources\nfunc retrieveServiceResources(ctx context.Context, label string, namespaces []string, kubeContext string) ([]*latest.PortForwardResource, error) {\n\tclient, err := kubernetesclient.Client(kubeContext)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"getting Kubernetes client: %w\", err)\n\t}\n\n\tvar resources []*latest.PortForwardResource\n\tfor _, ns := range namespaces {\n\t\tservices, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{\n\t\t\tLabelSelector: label,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"selecting services by label %q: %w\", label, err)\n\t\t}\n\t\tfor _, s := range services.Items {\n\t\t\tfor _, p := range s.Spec.Ports {\n\t\t\t\tresources = append(resources, &latest.PortForwardResource{\n\t\t\t\t\tType:      constants.Service,\n\t\t\t\t\tName:      s.Name,\n\t\t\t\t\tNamespace: s.Namespace,\n\t\t\t\t\tPort:      schemautil.FromInt(int(p.Port)),\n\t\t\t\t\tAddress:   constants.DefaultPortForwardAddress,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t}\n\treturn resources, nil\n}\n","sourceCodeStart":169,"sourceCodeEnd":203,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/kubernetes/portforward/resource_forwarder.go#L169-L203","documentation":"After obtaining a clientset, retrieveServiceResources lists Services in each namespace with the configured label selector. Any API list failure is wrapped as \"selecting services by label\". This is an API request failure, distinct from client-construction failure.","triggerScenarios":"client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label}) returns an error for any namespace — network failure, RBAC denial, expired credentials, or timeout during Start's service discovery.","commonSituations":"Service account lacks list-services RBAC in the namespace; token expired (cloud clusters need re-auth); API server temporarily unreachable; namespace name typo (can also yield forbidden on restricted namespaces).","solutions":["Test the exact query manually: kubectl get svc -n <ns> -l <label>","Fix RBAC with a role allowing list/get on services in the target namespaces","Re-authenticate to the cluster (gcloud/az/aws auth, minikube update-context)","Retry after confirming API server connectivity; add the label selector exists on services"],"exampleFix":"// before\nservices, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})\n// after (verify RBAC first)\n// kubectl auth can-i list services -n <ns>\n// grant: kubectl create role svc-lister --verb=list,get --resource=services -n <ns>\n//        kubectl create rolebinding svc-lister-binding --role=svc-lister --user=<user> -n <ns>","handlingStrategy":"retry","validationCode":"canList, err := exec.Command(\"kubectl\", \"auth\", \"can-i\", \"list\", \"services\", \"-n\", ns).Output()\nif err != nil || strings.TrimSpace(string(canList)) != \"yes\" {\n    return fmt.Errorf(\"no RBAC to list services in %s\", ns)\n}","typeGuard":null,"tryCatchPattern":"services, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})\nif err != nil {\n    if apierrors.IsForbidden(err) {\n        return nil, fmt.Errorf(\"RBAC: grant list on services in %s\", ns)\n    }\n    return retryWithBackoff(3, func() error {\n        _, err = client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{LabelSelector: label})\n        return err\n    })\n}","preventionTips":["Grant services list/get RBAC to the running user/serviceaccount","Re-authenticate to cloud clusters before long dev sessions","Verify label selectors exist on target services with kubectl get svc -l <label>"],"tags":["kubernetes","rbac","service-discovery"],"backgroundTag":"kubernetes-api-list-forbidden","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}