kubernetes/kops · error

listing namespaces: %w

Error message

listing namespaces: %w

What it means

DumpResources lists all cluster namespaces via the typed clientset (CoreV1().Namespaces().List) as its first API call, and wraps any failure with "listing namespaces: %w". The wrapped error is the raw client-go error (connection failure, timeout, or API StatusError such as 401/403). It is fatal for the dump because the namespace list is required to enumerate namespaced GVRs.

Source

Thrown at pkg/dump/resourcedumper.go:105

	}
	return &resourceDumper{
		k8sConfig:     k8sConfig,
		dynamicClient: dynamicClient,
		output:        output,
		artifactsDir:  artifactsDir,
	}, nil
}

func (d *resourceDumper) DumpResources(ctx context.Context) error {
	klog.Info("Dumping k8s resources")
	clientSet, err := kubernetes.NewForConfig(d.k8sConfig)
	if err != nil {
		return fmt.Errorf("creating clientset: %w", err)
	}

	namespaces, err := clientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("listing namespaces: %w", err)
	}

	discoveryClient, err := discovery.NewDiscoveryClientForConfig(d.k8sConfig)
	if err != nil {
		return fmt.Errorf("creating discovery client: %w", err)
	}

	resourceLists, err := discoveryClient.ServerPreferredResources()
	var discoveryErr *discovery.ErrGroupDiscoveryFailed
	if errors.As(err, &discoveryErr) {
		klog.Warningf("using incomplete list of API groups: %v", discoveryErr)
	} else if err != nil {
		return fmt.Errorf("listing server preferred resources: %w", err)
	}

	gvrNamespaces, err := getGVRNamespaces(resourceLists, namespaces.Items)
	if err != nil {
		return fmt.Errorf("getting GVR namespaces: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify connectivity to the API server (kubectl get namespaces) and fix kubeconfig/context or network (VPN, security groups).
2. Check credentials are valid and current (kubectl auth whoami / re-run kops export kubecfg).
3. Grant the identity RBAC to list namespaces: clusterrole with 'namespaces' resource, 'list'/'get' verbs via clusterrolebinding.
4. Retry after transient network issues; ensure the context deadline is not too short.

cfg, err := clientcmd.BuildConfigFromFlags("", kubeconfigPath)
if err != nil { return err }
client, err := kubernetes.NewForConfig(cfg)
if err != nil { return err }
if _, err := client.Discovery().ServerVersion(); err != nil {
	return fmt.Errorf("API server unreachable: %w", err)
}
rules, err := client.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx,
	&authv1.SelfSubjectAccessReview{
		Spec: authv1.SelfSubjectAccessReviewSpec{
			ResourceAttributes: &authv1.ResourceAttributes{
				Verb: "list", Resource: "namespaces",
			},
		},
	}, metav1.CreateOptions{})
if err != nil || !rules.Status.Allowed {
	return fmt.Errorf("identity cannot list namespaces: %v", err)
}

if err := dumper.DumpResources(ctx); err != nil {
	if k8sErrors.IsForbidden(err) || k8sErrors.IsUnauthorized(err) {
		// fix kubeconfig / RBAC before retrying
	} else if apierrors.IsTimeout(err) || k8sErrors.IsServerTimeout(err) {
		// transient: retry with backoff
	}
	return err
}

When it happens

Trigger: The k8sConfig points at an unreachable API server, credentials are rejected (401), the user lacks permission to list namespaces at cluster scope (403), or the context is cancelled/times out during the List call.

Common situations: Wrong --kubeconfig or stale KUBECONFIG context; kops export with an API server endpoint that has changed (ELB gone after cluster teardown); RBAC user without cluster-level 'list namespaces'; VPN not connected; API server security group blocks the caller.

Related errors

• listing server preferred resources: %w
• error adding needs-update label: %v
• error applying annotation to record addon installation: %v
• error querying namespace %q: %v
• error applying annotation to namespace: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9ca83ea9a917ea21. Report an issue: GitHub.