kubernetes/kops · error

error listing objects: %w

Error message

error listing objects: %w

What it means

While pruning objects of a GroupKind, the Pruner's LIST call against the Kubernetes API failed. The REST mapping succeeded, so this is a runtime API error (permissions, connectivity, or an invalid selector), wrapped with 'error listing objects'.

Source

Thrown at channels/pkg/channels/prune.go:96

func (p *Pruner) pruneObjectsOfKind(ctx context.Context, gk schema.GroupKind, spec *api.PruneKindSpec, keepObjects []*kubemanifest.Object) error {
	klog.Infof("pruning objects of kind: %v", gk)

	restMapping, err := p.RESTMapper.RESTMapping(gk)
	if err != nil {
		return fmt.Errorf("unable to find resource for %s: %w", gk, err)
	}

	gvr := restMapping.Resource

	var listOptions v1.ListOptions
	listOptions.LabelSelector = spec.LabelSelector
	listOptions.FieldSelector = spec.FieldSelector

	baseResource := p.Client.Resource(gvr)
	if len(spec.Namespaces) == 0 {
		objects, err := baseResource.List(ctx, listOptions)
		if err != nil {
			return fmt.Errorf("error listing objects: %w", err)
		}
		if err := p.pruneObjects(ctx, gvr, objects, keepObjects); err != nil {
			return err
		}
	} else {
		for _, namespace := range spec.Namespaces {
			resource := baseResource.Namespace(namespace)
			actualObjects, err := resource.List(ctx, listOptions)
			if err != nil {
				return fmt.Errorf("error listing objects in namespace %s: %w", namespace, err)
			}
			if err := p.pruneObjects(ctx, gvr, actualObjects, keepObjects); err != nil {
				return err
			}
		}
	}

	return nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error: 403 → fix RBAC; 400 → fix selector syntax; connection error → fix cluster access
2. Test the selector manually: `kubectl get <resource> -l <labelSelector> --all-namespaces`
3. Grant the kops service account list/get on the pruned group/resource
4. Remove unsupported fieldSelectors from the PruneKindSpec

Example fix

// before
listOptions.FieldSelector = "spec.someUnknownField=abc" // unsupported by CR
// after
listOptions.LabelSelector = "app=myapp" // use a supported label selector

// pre-check list permission cluster-wide
ok, err := authClient.SelfSubjectAccessReviews().Create(ctx, &authorizationv1.SelfSubjectAccessReview{
    Spec: authorizationv1.SelfSubjectAccessReviewSpec{
        ResourceAttributes: &authorizationv1.ResourceAttributes{
            Verb: "list", Group: gk.Group, Resource: resourceName}},
})
if err != nil || !ok.Status.Allowed {
    return fmt.Errorf("RBAC denies list on %s", resourceName)
}

if err := pruner.Prune(ctx, manifest, spec); err != nil {
    if strings.Contains(err.Error(), "error listing objects") {
        apiStatus := statusFromErr(errors.Unwrap(err)) // check codes 403/400
        return fmt.Errorf("prune list failed (%v); fix RBAC/selectors", apiStatus)
    }
    return err
}

When it happens

Trigger: Cluster-scoped prune path: dynamic client List with labelSelector/fieldSelector fails — forbidden by RBAC, invalid label/field selector syntax, API server unreachable, or the resource does not support the requested field selector.

Common situations: Service account lacking list permission on the resource cluster-wide; typo in labelSelector (e.g. unmatched quotes); field selector not supported by the resource (e.g. custom resources with limited field selectors); network/VPN down.

Related errors

• error listing objects in namespace %s: %w
• listing resources for %v: %w
• error listing Keysets: %v
• error adding needs-update label: %v
• error applying annotation to record addon installation: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0a31f8244fb33a2b. Report an issue: GitHub.