lima-vm/lima · error

failed to run %v: %w; stdout=%#q, stderr=%#q

Error message

failed to run %v: %w; stdout=%#q, stderr=%#q

What it means

canGetServices runs a kubectl probe (with KUBECONFIG set) capturing stdout/stderr, expecting the command to exit 0 with output `yes`. If the command exits nonzero, this error wraps the run error plus captured stdout and stderr, so the kubectl diagnostics are embedded in the message.

Source

Thrown at pkg/guestagent/kubernetesservice/kubernetesservice.go:118

	}
	for _, kc := range candidateKubeConfigs {
		if _, err := os.Stat(kc); !errors.Is(err, os.ErrNotExist) {
			return kc
		}
	}
	return ""
}

func canGetServices(ctx context.Context, kubectl, kubeconfig string) error {
	cmd := exec.CommandContext(ctx, kubectl, "auth", "can-i", "get", "service")
	if kubeconfig != "" {
		cmd.Env = append(os.Environ(), "KUBECONFIG="+kubeconfig)
	}
	var stdout, stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr
	if err := cmd.Run(); err != nil {
		return fmt.Errorf("failed to run %v: %w; stdout=%#q, stderr=%#q", cmd.Args, err, stdout.String(), stderr.String())
	}
	if strings.TrimSpace(stdout.String()) != "yes" {
		return fmt.Errorf("failed to run %v: expected `yes`, got %#q", cmd.Args, stdout.String())
	}
	return nil
}

func (s *ServiceWatcher) startAndStreamKubectl(cmd *exec.Cmd) error {
	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return err
	}

	var stderr bytes.Buffer
	cmd.Stderr = &stderr

	if err := cmd.Start(); err != nil {
		return fmt.Errorf("failed to run %v: %w; stderr=%#q", cmd.Args, err, stderr.String())

View on GitHub (pinned to dd909d0973)

Solutions

1. Read the embedded stderr in the message - it contains kubectl's own diagnosis (connection refused, unauthorized, etc.).
2. Verify the kubeconfig file exists and points at a reachable cluster (`kubectl --kubeconfig <path> cluster-info`).
3. Confirm the Kubernetes cluster/control plane inside the VM is running (`docker ps` / `kubectl get nodes`).
4. Ensure the kubectl binary exists in PATH within the guest.

Example fix

// before
KUBECONFIG=/nonexistent/config
// after
export KUBECONFIG=$HOME/.kube/config && kubectl cluster-info

if _, err := os.Stat(kubeconfig); err != nil {
    return fmt.Errorf("kubeconfig missing: %w", err)
}
if _, err := exec.LookPath("kubectl"); err != nil {
    return fmt.Errorf("kubectl not installed in guest")
}

if err := canGetServices(ctx, kubeconfig); err != nil {
    if strings.Contains(err.Error(), "connection refused") {
        // cluster still starting; retry with backoff
    }
    log.Printf("probe failed: %v", err) // stderr inside message has kubectl diagnosis
}

When it happens

Trigger: The kubectl probe command fails to execute or exits nonzero: kubeconfig path does not exist or is invalid, cluster API server is unreachable, auth credentials expired, or kubectl binary is missing (exec: not found).

Common situations: Kubernetes cluster in the VM is still starting or has crashed; kubeconfig generated for a different context/port; kubectl not installed in the guest; certificate/token expired after VM snapshot restore.

Related errors

• failed to run %v: expected `yes`, got %#q
• failed to run %v: %w; stderr=%#q
• failed to unmarshal line %#q: %w
• failed to unmarshal service object: %w (line=%#q)
• failed to scan kubectl event stream: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/fee56109abacb80a. Report an issue: GitHub.