What causes "ACCESS -- No API server connection" in derailed/k9s?

Run a.CheckConnectivity() (or reconnect/re-init the client) and retry only after it returns true

ACCESS -- No API server connection

Error message

ACCESS -- No API server connection

What it means

Returned by APIClient.CanI (internal/client/client.go:157) when the client's connection flag connOK is false. CanI performs a SelfSubjectAccessReview to answer RBAC queries; without a live API server connection the review cannot be sent, so the method refuses before constructing the request. connOK is set by CheckConnectivity() and cleared whenever RESTConfig load, clientset creation, or a ServerVersion() probe fails.

Source

Thrown at internal/client/client.go:157

// ActiveNamespace returns the current namespace.
func (a *APIClient) ActiveNamespace() string {
	if ns, err := a.CurrentNamespaceName(); err == nil {
		return ns
	}

	return BlankNamespace
}

func (a *APIClient) clearCache() {
	for _, k := range a.cache.Keys() {
		a.cache.Remove(k)
	}
}

// CanI checks if user has access to a certain resource.
func (a *APIClient) CanI(ns string, gvr *GVR, name string, verbs []string) (auth bool, err error) {
	if !a.getConnOK() {
		return false, errors.New("ACCESS -- No API server connection")
	}
	if gvr == NsGVR {
		// The name of the namespace is required to check permissions in some cases
		ns = name
	}
	if IsClusterWide(ns) {
		ns = BlankNamespace
	}
	if gvr == HmGVR {
		// helm stores release data in secrets
		gvr = SecGVR
	}
	key := makeCacheKey(ns, gvr, name, verbs)
	if v, ok := a.cache.Get(key); ok {
		if auth, ok = v.(bool); ok {
			return auth, nil
		}
	}

View on GitHub (pinned to 2d3ccc6ba2)

Solutions

Run a.CheckConnectivity() (or reconnect/re-init the client) and retry only after it returns true
Verify the kubeconfig current-context and endpoint reachability (kubectl cluster-info, kubectl auth can-i --list)
If the token comes from an exec plugin or oidc-login, refresh credentials and reconnect
If the cluster is gone, exit/restart the session instead of retrying against the stale client

Example fix

// before
auth, err := apiClient.CanI(ns, gvr, name, verbs)

// after
if !apiClient.CheckConnectivity() {
    return fmt.Errorf("api server unreachable; reconnect before checking access")
}
auth, err := apiClient.CanI(ns, gvr, name, verbs)

Defensive patterns

Strategy: validation

Validate before calling

// before calling CanI, verify the connection latch
if !apiClient.CheckConnectivity() {
    return fmt.Errorf("skip RBAC check: no API server connection")
}

Try / catch

// Go: treat as non-retryable precondition failure
auth, err := apiClient.CanI(ns, gvr, name, verbs)
if err != nil {
    if strings.Contains(err.Error(), "No API server connection") {
        // reconnect flow or degrade; do not spam retries
    }
    return err
}

Prevention

Connect and run CheckConnectivity once at startup before any RBAC-dependent feature
Subscribe to connectivity state changes and disable access-gated UI/actions when connOK is false
Recreate the APIClient after failed context switches instead of reusing it

When it happens

Trigger: Calling CanI() before the initial connection succeeds, after a context switch that failed, or after the API server became unreachable (VPN drop, cluster teardown, expired token) which flipped connOK to false via CheckConnectivity.

Common situations: Cluster deleted or stopped while k9s was open; kubeconfig pointing at a dead endpoint; exec-credential token expired mid-session; code path that uses the API client before Connection.Init/CheckConnectivity has run.

Related errors

AI-assisted analysis of derailed/k9s@2d3ccc6ba2 (2026-08-15). Data as JSON: /api/errors/ba35b72be902f8f3. Report an issue: GitHub.