kubernetes/kops · error

error listing objects in namespace %s: %w

Error message

error listing objects in namespace %s: %w

What it means

When the PruneKindSpec specifies Namespaces, pruning lists per-namespace via the namespaced dynamic client. A per-namespace List failure is wrapped as `error listing objects in namespace <ns>`, and prune aborts at the first failing namespace.

Source

Thrown at channels/pkg/channels/prune.go:106

	var listOptions v1.ListOptions
	listOptions.LabelSelector = spec.LabelSelector
	listOptions.FieldSelector = spec.FieldSelector

	baseResource := p.Client.Resource(gvr)
	if len(spec.Namespaces) == 0 {
		objects, err := baseResource.List(ctx, listOptions)
		if err != nil {
			return fmt.Errorf("error listing objects: %w", err)
		}
		if err := p.pruneObjects(ctx, gvr, objects, keepObjects); err != nil {
			return err
		}
	} else {
		for _, namespace := range spec.Namespaces {
			resource := baseResource.Namespace(namespace)
			actualObjects, err := resource.List(ctx, listOptions)
			if err != nil {
				return fmt.Errorf("error listing objects in namespace %s: %w", namespace, err)
			}
			if err := p.pruneObjects(ctx, gvr, actualObjects, keepObjects); err != nil {
				return err
			}
		}
	}

	return nil
}

func (p *Pruner) pruneObjects(ctx context.Context, gvr schema.GroupVersionResource, actualObjects *unstructured.UnstructuredList, keepObjects []*kubemanifest.Object) error {
	keepMap := make(map[string]*kubemanifest.Object)
	for _, keepObject := range keepObjects {
		key := keepObject.GetNamespace() + "/" + keepObject.GetName()
		keepMap[key] = keepObject
	}

	for _, actualObject := range actualObjects.Items {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify each namespace exists: `kubectl get ns <name>`; correct or remove stale entries in the PruneSpec
2. Grant list permission on the resource in every listed namespace
3. Retry after a stuck Terminating namespace is fully deleted
4. Check the wrapped inner error to distinguish 404/403/400

Example fix

// before
namespaces:
- kube-system
- old-namespace   # deleted from cluster
// after
namespaces:
- kube-system

for _, ns := range spec.Namespaces {
    if _, err := clientset.CoreV1().Namespaces().Get(ctx, ns, metav1.GetOptions{}); err != nil {
        return fmt.Errorf("prune namespace %s unavailable: %w", ns, err)
    }
}

if err := pruner.Prune(ctx, manifest, spec); err != nil {
    if strings.Contains(err.Error(), "error listing objects in namespace") {
        // extract ns from the message and decide: skip missing ns or fix RBAC
        return fmt.Errorf("prune aborted in namespace; reconcile namespaces: %w", err)
    }
    return err
}

When it happens

Trigger: A named namespace does not exist (404), RBAC denies list in that namespace, the namespace is terminating, or selectors are invalid — during the per-namespace List loop.

Common situations: PruneSpec Namespaces list contains a namespace removed/renamed in the cluster; service account role only covers some namespaces; namespace stuck in Terminating so list returns errors.

Related errors

• error listing objects: %w
• listing resources for %v: %w
• error querying namespace %q: %v
• building dynamic client: %w
• namespace was not provided for namespace-scoped object %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2900dbe7081d2f3b. Report an issue: GitHub.