{"record":{"id":"f84d1dd34e613056","repo":"GoogleContainerTools/skaffold","slug":"could-not-fetch-standalone-pods-w","errorCode":null,"errorMessage":"could not fetch standalone pods: %w","messagePattern":"could not fetch standalone pods: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/kubernetes/status/status_check.go","lineNumber":291,"sourceCode":"\n\t// Retrieve pending resource statuses\n\tgo func() {\n\t\ts.printResourceStatus(ctx, out, resources)\n\t}()\n\n\t// Wait for all deployment statuses to be fetched\n\twg.Wait()\n\treturn getSkaffoldDeployStatus(ctx, c, exitStatus)\n}\n\nfunc getStandalonePods(ctx context.Context, client kubernetes.Interface, ns string, l *label.DefaultLabeller, deadlineDuration time.Duration, tolerateFailures bool) ([]*resource.Resource, error) {\n\tvar result []*resource.Resource\n\tselector := validator.NewStandalonePodsSelector(client)\n\tpods, err := selector.Select(ctx, ns, metav1.ListOptions{\n\t\tLabelSelector: l.RunIDSelector(),\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not fetch standalone pods: %w\", err)\n\t}\n\tif len(pods) == 0 {\n\t\treturn result, nil\n\t}\n\tpd := diag.New([]string{ns}).\n\t\tWithLabel(label.RunIDLabel, l.Labels()[label.RunIDLabel]).\n\t\tWithValidators([]validator.Validator{validator.NewPodValidator(client, selector)})\n\tresult = append(result, resource.NewResource(string(resource.ResourceTypes.StandalonePods), resource.ResourceTypes.StandalonePods, ns, deadlineDuration, tolerateFailures).WithValidator(pd))\n\n\treturn result, nil\n}\n\nfunc getConfigConnectorResources(client kubernetes.Interface, dynClient dynamic.Interface, m manifest.ManifestList, ns string, l *label.DefaultLabeller, deadlineDuration time.Duration, tolerateFailures bool) ([]*resource.Resource, error) {\n\tvar result []*resource.Resource\n\tuRes, err := m.SelectResources(manifest.ConfigConnectorResourceSelector...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not fetch config connector resources: %w\", err)\n\t}","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/kubernetes/status/status_check.go#L273-L309","documentation":"Inside getStandalonePods, any error from listing pods via the standalone-pods selector is wrapped as 'could not fetch standalone pods' with the underlying error (%w). It bubbles to statusCheck's STATUSCHECK_STANDALONE_PODS_FETCH_ERR.","triggerScenarios":"NewStandalonePodsSelector(client).Select(ctx, ns, metav1.ListOptions{LabelSelector: l.RunIDSelector()}) fails: pods not listable in the namespace (RBAC), namespace absent, or API/network error.","commonSituations":"Multi-tenant cluster where the service account can't list pods; wrong statusCheck.namespace; cluster hiccups at status-check time after deploy; labeller run-id producing an invalid selector.","solutions":["Verify RBAC: 'kubectl auth can-i list pods -n <ns>' and add pods to the role if denied","Correct the namespace configured for the status check","Test with 'kubectl get pods -n <ns> --selector=<run-id-selector>' to reproduce the exact list call","Check label selector validity from the labeller's run-id label value","Retry once cluster connectivity is restored"],"exampleFix":"// before: role limited to deployments only\n//   kubectl create role ci --verb=get,list --resource=deployments.apps\n// after:\n//   kubectl create role ci --verb=get,list,watch --resource=deployments.apps,pods","handlingStrategy":"try-catch","validationCode":"const canList = execSync(`kubectl auth can-i list pods -n ${ns}`).toString().trim();\nif (canList !== 'yes') throw new Error(`RBAC: cannot list pods in ${ns}`);","typeGuard":"function isStandalonePodsFetchErr(err) {\n  return err != null && typeof err.message === 'string' && err.message.includes('could not fetch standalone pods');\n}","tryCatchPattern":"try {\n  await statusCheck();\n} catch (err) {\n  if (isStandalonePodsFetchErr(err)) {\n    // unwrap cause: RBAC (403) vs network vs namespace\n    log.error('standalone pod listing failed:', err.cause ?? err.message);\n  }\n  throw err;\n}","preventionTips":["Pre-check 'kubectl auth can-i list pods' in setup scripts","Keep namespace config consistent and typo-free","Confirm cluster reachability before status check phase","Retry on transient network failures with backoff"],"tags":["kubernetes","pods","rbac","api-server"],"backgroundTag":"kubernetes-api-list-forbidden","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}