kubernetes/kops · error

error listing pods: %v

Error message

error listing pods: %v

What it means

podController.runUpdater wraps failures from client.CoreV1().Pods(c.namespace).List(ctx, listOpts) as "error listing pods: %v". The controller lists pods (all pods or a single namespace) to build DNS records for pod IPs; on failure the sync is aborted and retried. The wrapped error identifies the underlying client-go failure.

Source

Thrown at dns-controller/pkg/watchers/pod.go:80

	stopCh := c.StopChannel()
	go c.runWatcher(stopCh)

	<-stopCh
	klog.Infof("shutting down pod controller")
}

func (c *PodController) runWatcher(stopCh <-chan struct{}) {
	runOnce := func() (bool, error) {
		ctx := context.TODO()

		var listOpts metav1.ListOptions
		klog.V(4).Infof("querying without label filter")

		allKeys := c.scope.AllKeys()

		podList, err := c.client.CoreV1().Pods(c.namespace).List(ctx, listOpts)
		if err != nil {
			return false, fmt.Errorf("error listing pods: %v", err)
		}
		foundKeys := make(map[string]bool)
		for i := range podList.Items {
			pod := &podList.Items[i]
			klog.V(4).Infof("found pod: %v", pod.Name)
			key := c.updatePodRecords(pod)
			foundKeys[key] = true
		}
		for _, key := range allKeys {
			if !foundKeys[key] {
				// The pod previous existed, but no longer exists; delete it from the scope
				klog.V(2).Infof("removing pod not found in list: %s", key)
				c.scope.Replace(key, nil)
			}
		}
		c.scope.MarkReady()

		listOpts.Watch = true

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the controller's ServiceAccount 'list'/'get' on pods in the configured namespace (or cluster-wide when namespace is empty).
2. Verify the --watch-namespace value exists and is spelled correctly.
3. Check the wrapped error after '%v': 403 => RBAC, timeout => connectivity.
4. Rely on the built-in retry for transient failures; investigate only if it loops.

Example fix

// before: pod list denied in namespace
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["list","watch"]
// after: add pods
rules:
- apiGroups: [""]
  resources: ["services","pods"]
  verbs: ["list","watch"]

// Go: preflight pod list in the target namespace
ns := "" // empty means all namespaces
if _, err := client.CoreV1().Pods(ns).List(ctx, metav1.ListOptions{Limit: 1}); err != nil {
    return fmt.Errorf("preflight pod list failed: %w", err)
}

podList, err := client.CoreV1().Pods(c.namespace).List(ctx, listOpts)
if err != nil {
    klog.Errorf("pod list failed in ns %q: %v", c.namespace, err)
    time.Sleep(backoff)
    return false, nil
}

When it happens

Trigger: client.CoreV1().Pods(c.namespace).List(ctx, listOpts) errors: 403 (missing RBAC 'list pods' in the target namespace), context deadline, invalid namespace, or network failure to the apiserver.

Common situations: Namespace-restricted dns-controller whose ServiceAccount lacks pod list rights in that namespace; the specified namespace does not exist; apiserver connectivity problems during cluster upgrades.

Related errors

• error listing nodes: %v
• error watching nodes: %v
• error watching pods: %v
• error listing services: %v
• error listing Pods: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/fe31f24bc5ad3bc0. Report an issue: GitHub.