kubernetes/kops · error

listing server preferred resources: %w

Error message

listing server preferred resources: %w

What it means

The discovery client's ServerPreferredResources() call is wrapped with "listing server preferred resources: %w", but only when the error is NOT a *discovery.ErrGroupDiscoveryFailed. Partial group-discovery failures are tolerated (logged as a warning) because the dump can proceed with the groups it did discover; total failure (network, auth, no reachable server) returns this error.

Source

Thrown at pkg/dump/resourcedumper.go:118

		return fmt.Errorf("creating clientset: %w", err)
	}

	namespaces, err := clientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("listing namespaces: %w", err)
	}

	discoveryClient, err := discovery.NewDiscoveryClientForConfig(d.k8sConfig)
	if err != nil {
		return fmt.Errorf("creating discovery client: %w", err)
	}

	resourceLists, err := discoveryClient.ServerPreferredResources()
	var discoveryErr *discovery.ErrGroupDiscoveryFailed
	if errors.As(err, &discoveryErr) {
		klog.Warningf("using incomplete list of API groups: %v", discoveryErr)
	} else if err != nil {
		return fmt.Errorf("listing server preferred resources: %w", err)
	}

	gvrNamespaces, err := getGVRNamespaces(resourceLists, namespaces.Items)
	if err != nil {
		return fmt.Errorf("getting GVR namespaces: %w", err)
	}

	jobs := make(chan gvrNamespace, len(gvrNamespaces))
	results := make(chan resourceDumpResult, len(gvrNamespaces))

	for i := 0; i < resourceDumpConcurrency; i++ {
		go d.dumpGVRNamespaces(ctx, jobs, results)
	}

	var dumpErr error

	for _, gvrn := range gvrNamespaces {
		jobs <- gvrn

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check API server health (kubectl get --raw /apis) and network path.
2. Re-check auth: kubectl auth can-i get --all and ensure the discovery API is permitted.
3. Retry the dump; discovery is a single GET pair and transient outages resolve it.
4. If ErrGroupDiscoveryFailed is logged instead, address the failing group's aggregated API server (install/fix the CRD or aggregation layer).

disc, err := discovery.NewDiscoveryClientForConfig(cfg)
if err != nil { return err }
if _, err := disc.ServerVersion(); err != nil {
	return fmt.Errorf("discovery endpoint unreachable: %w", err)
}

func isPartialDiscoveryFailed(err error) bool {
	var gdf *discovery.ErrGroupDiscoveryFailed
	// partial failure is tolerated by DumpResources; only total failure returns
	return errors.As(err, &gdf)
}

if err := dumper.DumpResources(ctx); err != nil {
	if k8sErrors.IsUnauthorized(err) || k8sErrors.IsForbidden(err) {
		// auth problem on discovery endpoints — fix credentials/RBAC
	} else if strings.Contains(err.Error(), "listing server preferred resources") {
		// total discovery failure: check apiserver health, then retry
	}
	return err
}

When it happens

Trigger: The /apis and /api discovery endpoints are entirely unreachable or rejected: connection failure, 401/403, context cancellation, or a server that cannot serve discovery at all. Aggregated-apiserver outages alone produce ErrGroupDiscoveryFailed, which is NOT this error.

Common situations: API server briefly down mid-dump; RBAC identity can list namespaces but cannot hit discovery endpoints; heavily aggregated clusters where a non-ErrGroupDiscoveryFailed error surfaces; TLS intercepting proxies breaking the discovery response.

Related errors

• error querying kubernetes version: %v
• listing namespaces: %w
• unable to find resource for %s: %w
• cannot parse kubernetes version %q
• error building corev1 client: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cdda121abb01aa1a. Report an issue: GitHub.