kubernetes/kops · error

cannot fetch channel versions from namespaces: %w

Error message

cannot fetch channel versions from namespaces: %w

What it means

applyMenu first queries installed channel versions by listing all namespaces via the Kubernetes API. If that List call fails, 'cannot fetch channel versions from namespaces: %w' wraps the cause and aborts the apply, because the tool cannot determine what is already installed.

Source

Thrown at channels/pkg/cmd/apply_channel.go:224

	for _, channelLocation := range args {
		menu, err := buildMenu(f.VFSContext(), kubernetesVersion, channelLocation)
		if err != nil {
			merr = multierr.Append(merr, fmt.Errorf("building menu for %q: %w", channelLocation, err))
			continue
		}
		if err := applyMenu(ctx, menu, f.VFSContext(), k8sClient, cmClient, dynamicClient, restMapper, options.Yes); err != nil {
			merr = multierr.Append(merr, fmt.Errorf("applying %q: %w", channelLocation, err))
		}
	}
	return merr
}

func applyMenu(ctx context.Context, menu *channels.AddonMenu, vfsContext *vfs.VFSContext, k8sClient kubernetes.Interface, cmClient certmanager.Interface, dynamicClient dynamic.Interface, restMapper *restmapper.DeferredDiscoveryRESTMapper, apply bool) error {
	// channelVersions is the list of installed addons in the cluster.
	// It is keyed by <namespace>:<addon name>.
	channelVersions, err := getChannelVersions(ctx, k8sClient)
	if err != nil {
		return fmt.Errorf("cannot fetch channel versions from namespaces: %w", err)
	}

	updates, needUpdates, err := getUpdates(ctx, menu, k8sClient, cmClient, channelVersions)
	if err != nil {
		return fmt.Errorf("failed to get updates: %w", err)
	}

	if len(updates) == 0 {
		fmt.Printf("No update required\n")
		return nil
	}

	{
		t := &tables.Table{}
		t.AddColumn("NAME", func(r *channels.AddonUpdate) string {
			return r.Name
		})
		t.AddColumn("CURRENT", func(r *channels.AddonUpdate) string {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reproduce the cause with `kubectl get namespaces`
2. Fix credentials/kubeconfig (kops export kubecfg --name <cluster>)
3. Grant RBAC list permission on namespaces
4. Retry once connectivity/auth is restored

Example fix

// before
kops apply channel https://.../addon.yaml  # cannot fetch channel versions
// after
kops export kubecfg --name mycluster
kubectl get namespaces  # verify access
kops apply channel https://.../addon.yaml

_, err := k8sClient.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
if err != nil {
	return fmt.Errorf("cannot list namespaces, check kubeconfig/RBAC first: %w", err)
}

var nsList *v1.NamespaceList
err := retry.OnError(wait.Backoff{Steps: 3, Duration: time.Second}, func(err error) bool { return true }, func() error {
	var e error
	nsList, e = k8sClient.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
	return e
})
if err != nil {
	return fmt.Errorf("namespaces unreachable after retries: %w", err)
}

When it happens

Trigger: k8sClient.CoreV1().Namespaces().List errors: API server unreachable, expired credentials, or RBAC denying cluster-scoped namespace list.

Common situations: Stale kubeconfig pointing at a deleted cluster, expired cloud/OIDC token, network partition/VPN down, restricted RBAC profiles without namespace list permission.

Related errors

• error listing namespaces: %v
• error applying annotation to record addon installation: %v
• updating Role Assignment is not yet implemented
• error adding needs-update label: %v
• error querying namespace %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4792cfe4a1608852. Report an issue: GitHub.