Improve error message for action on missing namespace

[techmaharaj]

What happened:

When a <namespace> is not present, running kubectl get pods -n <namespace> shows the error messages as No resources found in <namespace> namespace.

It works fine when running kubectl get ns <namespace> as it then gives an error Error from server (NotFound): namespaces "<namespace>" not found

What you expected to happen:

Since the namespace is not created in the first place, it should show a message that namespaces <namespace> not found rather than No resources found in namespace

How to reproduce it (as minimally and precisely as possible):

• Deploy a K8s cluster
• Run the command kubectl get pods -n test (ensure that the namespace test is not already present)

[k8s-ci-robot]

@techmaharaj: This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ardaguclu]

I think, your suggestion seems reasonable. However, this change would affect all of kubectl commands. Moreover, these messages are here for a long time and although their context is arguable, external scripts relying on this message will fail which we don't want.

[techmaharaj]

Sure, I've not checked this with other kubectl commands, but this one felt odd. Frankly, I don't quite understand the complete complexity of the changes required to fix this, but I feel we should improve such verbiage to avoid any confusion to the user.

[sftim]

/retitle Improve error message for action on missing namespace

I think we'd need API support so that kubectl can tell the cause of the 404 response (missing namespace? missing pod?) atomically. If kubectl were to make 2 requests, the API state might have changed between the first and second request.

Then kubectl could print its existing error message and a hint that you might be looking in a nonexistent namespace.

If we had that API support, kubectl could add colored hint output to stderr, whenever stderr is a terminal (or equivalent for other OSs such as Windows). This idea is similar to how kubectl already supports printing warnings.

[soltysh]

This is intentional see this comment for more details #1118 (comment). In short the server hides the information whether you don't have access to a namespace or it doesn't exist to not make it easy to iterate over cluster namespaces and read its full contents.

/close

[k8s-ci-robot]

@soltysh: Closing this issue.

In response to this:

This is intentional see this comment for more details #1118 (comment). In short the server hides the information whether you don't have access to a namespace or it doesn't exist to not make it easy to iterate over cluster namespaces and read its full contents.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sftim]

@soltysh do you think we could improve the user experience here, so that the user at least knows that “invalid namespace” is a possible explanation?

[sftim]

If we're willing to have kubectl make a second request but only use a 404 from that get to print a hint (ie, not implying authoritatively that the issue is down to a missing namespace), that might help users without presenting a security risk.

A user not entitled to check the namespace would get a 403 Forbidden response and kubectl could then print a more neutral message.

[RinkiyaKeDad]

@soltysh do you think we could improve the user experience here, so that the user at least knows that “invalid namespace” is a possible explanation?

Maybe the error message could read, "No resources in the namespace or the namespace doesn't exist"?