kubernetes/kops · error

error querying namespace %q: %v

Error message

error querying namespace %q: %v

What it means

GetInstalledVersion reads the installed channel version from an annotation on the channel's namespace. Before it can read the annotation, it fetches the namespace via the Kubernetes API; if that GET fails (namespace missing, RBAC denied, API server unreachable), the raw client error is wrapped with this message. It indicates the version could not be determined because the namespace itself could not be queried.

Source

Thrown at channels/pkg/channels/channel_version.go:148

	if existing.SystemGeneration != c.SystemGeneration {
		if existing.SystemGeneration > c.SystemGeneration {
			klog.V(4).Infof("cluster has newer SystemGeneration for %q (%v vs %v), will not replace", name, existing.SystemGeneration, c.SystemGeneration)
			return false
		} else {
			klog.V(4).Infof("cluster has different SystemGeneration for %q (%v vs %v); will replace", name, existing.SystemGeneration, c.SystemGeneration)
			return true
		}
	}

	klog.V(4).Infof("manifest Match for %q: %v", name, existing)
	return false
}

func (c *Channel) GetInstalledVersion(ctx context.Context, k8sClient kubernetes.Interface) (*ChannelVersion, error) {
	ns, err := k8sClient.CoreV1().Namespaces().Get(ctx, c.Namespace, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("error querying namespace %q: %v", c.Namespace, err)
	}

	annotationValue, ok := ns.Annotations[c.AnnotationName()]
	if !ok {
		return nil, nil
	}

	return ParseChannelVersion(annotationValue)
}

func (c *Channel) IsPKIInstalled(ctx context.Context, k8sClient kubernetes.Interface, cmClient certmanager.Interface) (bool, error) {
	_, err := k8sClient.CoreV1().Secrets("kube-system").Get(ctx, c.Name+"-ca", metav1.GetOptions{})
	if errors.IsNotFound(err) {
		return false, nil
	}
	if err != nil {
		return true, err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the namespace exists: kubectl get namespace <name> in the target cluster.
2. Check kubeconfig context points at the correct cluster.
3. Grant the identity RBAC get permission on namespaces (clusterrole with 'namespaces' resource, 'get' verb).
4. Check API server reachability and network/VPN connectivity.

Example fix

// before
ch := channels.AddonsChannel(namespace, name) // namespace not created
v, err := ch.GetInstalledVersion(ctx, client)
// after
if _, err := client.CoreV1().Namespaces().Get(ctx, namespace, metav1.GetOptions{}); err != nil {
    // create the namespace or fix the name before querying the version
}
v, err := ch.GetInstalledVersion(ctx, client)

nsClient := k8sClient.CoreV1().Namespaces()
if _, err := nsClient.Get(ctx, namespace, metav1.GetOptions{}); err != nil {
    return fmt.Errorf("namespace %q not queryable: %w", namespace, err)
}

func isNamespaceMissing(err error) bool {
    return apierrors.IsNotFound(err)
}

v, err := ch.GetInstalledVersion(ctx, k8sClient)
if err != nil {
    if apierrors.IsNotFound(err) {
        // namespace absent: treat as no installed version or create it
        return nil, nil
    }
    return fmt.Errorf("GetInstalledVersion: %w", err)
}

When it happens

Trigger: Calling Channel.GetInstalledVersion when the namespace does not exist (NotFound), the caller lacks get permission on namespaces (Forbidden), or the API server connection fails (connection refused / timeout).

Common situations: Pointing the channel at a namespace in a different cluster than intended; running kops with insufficient kubeconfig credentials; typo'd namespace name; API server down or kubeconfig misconfigured.

Related errors

• error listing nodes: %v
• error getting host %v: %w
• error listing Keysets: %v
• error updating keyset %q: %v
• error reading SSHCredential: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/15e922cd53ba957f. Report an issue: GitHub.