diff --git a/src/kubernetes.cc b/src/kubernetes.cc
index a04d4e51..5433dd30 100644
--- a/src/kubernetes.cc
+++ b/src/kubernetes.cc
@@ -163,37 +163,47 @@ json::value KubernetesReader::ComputePodAssociations(const json::Object* pod)
     const throw(json::Exception) {
   const json::Object* metadata = pod->Get<json::Object>("metadata");
   const std::string namespace_name = metadata->Get<json::String>("namespace");
-  const std::string pod_id = metadata->Get<json::String>("uid");
-
-  const json::value top_level = FindTopLevelController(
-      namespace_name, pod->Clone());
-  const json::Object* top_level_controller = top_level->As<json::Object>();
-  const json::Object* top_level_metadata =
-      top_level_controller->Get<json::Object>("metadata");
-  const std::string top_level_name =
-      top_level_metadata->Get<json::String>("name");
-  if (!top_level_controller->Has("kind") &&
-      top_level_metadata->Get<json::String>("uid") != pod_id) {
-    LOG(ERROR) << "Internal error; top-level controller without 'kind' "
-               << *top_level_controller
-               << " not the same as pod " << *pod;
-  }
-  const std::string top_level_kind =
-      top_level_controller->Has("kind")
-          ? top_level_controller->Get<json::String>("kind")
-          : "Pod";
 
   json::value instance_resource =
       InstanceReader::InstanceResource(environment_).ToJSON();
 
   std::unique_ptr<json::Object> raw_associations(new json::Object({
     {"infrastructureResource", std::move(instance_resource)},
-    {"controllers", json::object({
-      {"topLevelControllerType", json::string(top_level_kind)},
-      {"topLevelControllerName", json::string(top_level_name)},
-    })},
   }));
 
+  try {
+    const json::value top_level = FindTopLevelController(
+        namespace_name, pod->Clone());
+    const json::Object* top_level_controller = top_level->As<json::Object>();
+    const json::Object* top_level_metadata =
+        top_level_controller->Get<json::Object>("metadata");
+    const std::string top_level_name =
+        top_level_metadata->Get<json::String>("name");
+    const std::string pod_id = metadata->Get<json::String>("uid");
+    if (!top_level_controller->Has("kind") &&
+        top_level_metadata->Get<json::String>("uid") != pod_id) {
+      LOG(ERROR) << "Internal error; top-level controller without 'kind' "
+                 << *top_level_controller
+                 << " not the same as pod " << *pod;
+    }
+    const std::string top_level_kind =
+        top_level_controller->Has("kind")
+            ? top_level_controller->Get<json::String>("kind")
+            : "Pod";
+
+    raw_associations->emplace(std::make_pair(
+      "controllers",
+      json::object({
+        {"topLevelControllerType", json::string(top_level_kind)},
+        {"topLevelControllerName", json::string(top_level_name)},
+      })
+    ));
+  } catch (const QueryException& e) {
+    LOG(ERROR) << "Error while finding top-level controller for "
+               << namespace_name << "." << metadata->Get<json::String>("name")
+               << ": " << e.what();
+  }
+
   const json::Object* spec = pod->Get<json::Object>("spec");
   if (spec->Has("nodeName")) {
     // Pods that have been scheduled will have a nodeName.
@@ -666,10 +676,12 @@ json::value KubernetesReader::QueryMaster(const std::string& path) const
   try {
     http::client::response response = client.get(request);
     if (status(response) >= 400 && status(response) <= 403) {
-      throw NonRetriableError(
+      const std::string what =
           format::Substitute("Server responded with '{{message}}' ({{code}})",
                              {{"message", status_message(response)},
-                              {"code", format::str(status(response))}}));
+                              {"code", format::str(status(response))}});
+      LOG(ERROR) << "Failed to query " << endpoint << ": " << what;
+      throw NonRetriableError(what);
     } else if (status(response) >= 300) {
       throw boost::system::system_error(
           boost::system::errc::make_error_code(boost::system::errc::not_connected),