GoogleContainerTools/skaffold · error

patching resource %s/%q: %w

Error message

patching resource %s/%q: %w

What it means

After computing a strategic merge patch carrying the skaffold labels, the namespaced resource is patched through the dynamic client's Resource(gvr).Namespace(ns).Patch. This error wraps any API server rejection or transport failure during that patch call.

Source

Thrown at pkg/skaffold/deploy/label/labels.go:121

		return fmt.Errorf("getting group version resource from obj: %w", err)
	}

	if namespaced {
		var namespace string
		if accessor.GetNamespace() != "" {
			namespace = accessor.GetNamespace()
		} else {
			namespace = res.Namespace
		}

		ns, err := resolveNamespace(namespace, kubeContext)
		if err != nil {
			return fmt.Errorf("resolving namespace: %w", err)
		}

		log.Entry(ctx).Debug("Patching", name, "in namespace", ns)
		if _, err := client.Resource(gvr).Namespace(ns).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {
			return fmt.Errorf("patching resource %s/%q: %w", ns, name, err)
		}
	} else {
		log.Entry(ctx).Debug("Patching", name)
		if _, err := client.Resource(gvr).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {
			return fmt.Errorf("patching resource %q: %w", name, err)
		}
	}

	return nil
}

func resolveNamespace(ns, kubeContext string) (string, error) {
	if ns != "" {
		return ns, nil
	}
	cfg, err := kubectx.CurrentConfig()
	if err != nil {
		return "", fmt.Errorf("getting kubeconfig: %w", err)

View on GitHub (pinned to a1189de023)

Solutions

1. Check RBAC: `kubectl auth can-i patch <resource> -n <ns>` — bind a role with patch permission if denied
2. Confirm the resource exists in the resolved namespace: `kubectl get <resource> -n <ns>`
3. Verify cluster connectivity and API server health (`kubectl cluster-info`)
4. Rerun the deploy — transient network errors during labeling resolve on retry

// preflight RBAC check
allowed, err := authClient.SelfSubjectAccessReviews().Create(ctx,
    &authv1.SelfSubjectAccessReview{Spec: authv1.SelfSubjectAccessReviewSpec{
        ResourceAttributes: &authv1.ResourceAttributes{Verb: "patch", Resource: resource, Namespace: ns}}})
// allowed.Status.Allowed must be true

if _, err := client.Resource(gvr).Namespace(ns).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {
    if apierrors.IsNotFound(err) { return nil } // object gone, skip labeling
    if apierrors.IsForbidden(err) { return fmt.Errorf("RBAC: cannot patch %s/%s: %w", ns, name, err) }
    return retryable(err)
}

When it happens

Trigger: Patch request against a namespaced resource fails: 404 (object gone), 403 (RBAC denies patch), 409/422 (conflict or schema validation), network timeout, or wrong namespace so the object doesn't exist there.

Common situations: ServiceAccount lacks patch permission (RBAC in CI); resource deleted between deploy and label; namespace mismatch between manifest and kubeconfig default; API server briefly unreachable.

Related errors

• patching resource %q: %w
• listing pods: %w
• STATUSCHECK_DEPLOYMENT_FETCH_ERR
• STATUSCHECK_STATEFULSET_FETCH_ERR
• STATUSCHECK_STANDALONE_PODS_FETCH_ERR

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/8f00210b212dfbfa. Report an issue: GitHub.