kubernetes/kops · error

error listing Pods: %v

Error message

error listing Pods: %v

What it means

collectPodFailures lists Pods (in the loop whose error is aggregated by the errgroup-style construct) to determine master static pod and general pod health. A failed list is wrapped as "error listing Pods". Because pod presence is part of validation, a list failure aborts the pod-health phase.

Source

Thrown at pkg/validation/validate_cluster.go:330

		var notready []string
		for _, container := range pod.Status.ContainerStatuses {
			if !container.Ready {
				notready = append(notready, container.Name)
				log.V(2).Info("container not ready", "pod", pod.Name, "container", container.Name, "state", container.State)
			}
		}
		if len(notready) != 0 {
			v.addError(&ValidationError{
				Kind:          "Pod",
				Name:          pod.Namespace + "/" + pod.Name,
				Message:       fmt.Sprintf("%s pod %q is not ready (%s)", priority, pod.Name, strings.Join(notready, ",")),
				InstanceGroup: podNode,
			})
		}
		return nil
	})
	if err != nil {
		return fmt.Errorf("error listing Pods: %v", err)
	}

	for node, nodeMap := range masterWithoutPod {
		for app := range nodeMap {
			v.addError(&ValidationError{
				Kind:          "Node",
				Name:          node,
				Message:       fmt.Sprintf("control-plane node %q is missing %s pod", node, app),
				InstanceGroup: nodeInstanceGroupMapping[node],
			})
		}
	}

	return nil
}

func (v *ValidationCluster) validateNodes(cloudGroups map[string]*cloudinstances.CloudInstanceGroup, groups []*kops.InstanceGroup, shouldValidateInstanceGroup func(ig *kops.InstanceGroup) bool, toleratedNodes map[string]bool) ([]v1.Node, map[string]*kops.InstanceGroup) {
	var readyNodes []v1.Node

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run kubectl get pods -A (or in kube-system) to reproduce the underlying error
2. Fix RBAC for the validating identity to list pods cluster-wide
3. Restore API reachability (VPN/VPC) and re-run validation
4. Retry after transient API errors; verify the cluster context in kubeconfig matches the target cluster

Example fix

// before
$ kops validate cluster
# error listing Pods: pods is forbidden: User "ci" cannot list resource "pods" ...
// after
$ kubectl create clusterrolebinding ci-pods --clusterrole=system:node --user=ci  # or use an admin-capable identity
$ kops validate cluster

_, err := k8sClient.CoreV1().Pods(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})
if err != nil {
    return fmt.Errorf("pod list precondition failed: %v", err)
}

err := wait.PollImmediate(5*time.Second, time.Minute, func() (bool, error) {
    _, err := k8sClient.CoreV1().Pods(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})
    return err == nil, nil
})
if err != nil {
    return fmt.Errorf("pods remained unlistable: %w", err)
}

When it happens

Trigger: The Kubernetes pod list call inside collectPodFailures returns an error — RBAC denial, namespace not found, API server unreachable, or context cancellation — which is returned by the run-group and wrapped here.

Common situations: Validating with a kubeconfig user lacking list pods permission; API server flapping during rolling update; private API endpoint validated from outside the network; deleted/recreated namespaces mid-validation.

Related errors

• error listing nodes: %v
• cannot get pod health for %q: %v
• error listing pods: %v
• error listing machines: %w
• error listing Keysets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9bbd0ff028875b7d. Report an issue: GitHub.