kubernetes/kops · error

error listing services: %v

Error message

error listing services: %v

What it means

serviceController.runUpdater wraps failures from client.CoreV1().Services(c.namespace).List(ctx, listOpts) as "error listing services: %v". Services are listed to build/refresh DNS records (e.g. for LoadBalancer services); a failed list aborts the sync and it is retried. The wrapped client-go error names the real cause.

Source

Thrown at dns-controller/pkg/watchers/service.go:79

	stopCh := c.StopChannel()
	go c.runWatcher(stopCh)

	<-stopCh
	klog.Infof("shutting down service controller")
}

func (c *ServiceController) runWatcher(stopCh <-chan struct{}) {
	runOnce := func() (bool, error) {
		ctx := context.TODO()

		var listOpts metav1.ListOptions
		klog.V(4).Infof("querying without label filter")

		allKeys := c.scope.AllKeys()
		serviceList, err := c.client.CoreV1().Services(c.namespace).List(ctx, listOpts)
		if err != nil {
			return false, fmt.Errorf("error listing services: %v", err)
		}
		foundKeys := make(map[string]bool)
		for i := range serviceList.Items {
			service := &serviceList.Items[i]
			klog.V(4).Infof("found service: %v", service.Name)
			key := c.updateServiceRecords(service)
			foundKeys[key] = true
		}
		for _, key := range allKeys {
			if !foundKeys[key] {
				// The service previously existed, but no longer exists; delete it from the scope
				klog.V(2).Infof("removing service not found in list: %s", key)
				c.scope.Replace(key, nil)
			}
		}
		c.scope.MarkReady()

		listOpts.Watch = true

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant 'list'/'get' on services to the controller's ServiceAccount in the target namespace.
2. Confirm the --watch-namespace exists; an empty namespace watches all.
3. Decode the wrapped error after '%v' (403 vs timeout) and act accordingly.
4. Ignore one-off transient failures; the controller retries automatically.

Example fix

// before
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list","watch"]
// after
rules:
- apiGroups: [""]
  resources: ["pods","services"]
  verbs: ["list","watch"]

// Go: preflight service list in the target namespace
if _, err := client.CoreV1().Services(ns).List(ctx, metav1.ListOptions{Limit: 1}); err != nil {
    return fmt.Errorf("preflight service list failed: %w", err)
}

serviceList, err := client.CoreV1().Services(c.namespace).List(ctx, listOpts)
if err != nil {
    klog.Errorf("service list failed in ns %q: %v", c.namespace, err)
    time.Sleep(backoff)
    return false, nil
}

When it happens

Trigger: client.CoreV1().Services(c.namespace).List(ctx, listOpts) errors: RBAC 403 on services list, invalid/nonexistent namespace, apiserver unreachable, or context timeout.

Common situations: Namespace-scoped ServiceAccount missing service list permissions; typo'd --watch-namespace; apiserver connectivity loss during control-plane upgrades.

Related errors

• error listing nodes: %v
• error watching nodes: %v
• error listing pods: %v
• error watching services: %v
• error adding needs-update label: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/026286d9c00c98ff. Report an issue: GitHub.