{"record":{"id":"3a3ceab4b50733d6","repo":"kubernetes/kops","slug":"failed-to-apply-the-manifest-w","errorCode":null,"errorMessage":"failed to apply the manifest: %w","messagePattern":"failed to apply the manifest: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"channels/pkg/channels/kubectlapplier.go","lineNumber":72,"sourceCode":"\t\tif err != nil {\n\t\t\tklog.Errorf(\"failed to apply the manifest: %v\", err)\n\t\t}\n\n\t}\n\n\t// Replace will force ownership on all fields to kops. But on some k8s versions, this will fail on e.g trying to set clusterIP to \"\".\n\t{\n\t\t_, err := execKubectl(ctx, \"replace\", \"-f\", localManifestFile, \"--field-manager=kops\")\n\t\tif err != nil {\n\t\t\tklog.Errorf(\"failed to replace manifest: %v\", err)\n\t\t}\n\t}\n\n\t// Do a final replace to ensure resources are correctly apply. This should always succeed if the addon is updated as expected.\n\t{\n\t\t_, err := execKubectl(ctx, \"apply\", \"-f\", localManifestFile, \"--server-side\", \"--force-conflicts\", \"--field-manager=kops\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to apply the manifest: %w\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc execKubectl(ctx context.Context, args ...string) (string, error) {\n\tkubectlPath := \"kubectl\" // Assume in PATH\n\tcmd := exec.CommandContext(ctx, kubectlPath, args...)\n\tenv := os.Environ()\n\tcmd.Env = env\n\n\thuman := strings.Join(cmd.Args, \" \")\n\tklog.V(2).Infof(\"Running command: %s\", human)\n\toutput, err := cmd.CombinedOutput()\n\tif err != nil {\n\t\tklog.Infof(\"error running %s\", human)\n\t\tklog.Info(string(output))","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/channels/pkg/channels/kubectlapplier.go#L54-L90","documentation":"KubectlApplier.Apply writes the addon manifest to a temp file and runs `kubectl apply --server-side --force-conflicts` three times (apply, replace, final apply). This error is returned by the final apply, which kOps treats as authoritative: if it fails, the addon was not converged as expected. The underlying kubectl stderr is wrapped via %w.","triggerScenarios":"The final `kubectl apply -f <manifest> --server-side --force-conflicts --field-manager=kops` exits non-zero — e.g. the manifest is invalid, the API server rejects a field (immutable field conflicts, missing CRDs), RBAC denies access, or kubectl is missing/cannot reach the cluster.","commonSituations":"Addon manifests referencing CRDs not yet installed; server-side apply conflicts on fields owned by another manager; immutable fields changed (e.g. Service clusterIP); kubeconfig/context problems; older kubectl without --server-side support.","solutions":["Re-run `kubectl apply -f manifest.yaml --server-side --force-conflicts --field-manager=kops` manually to see the full kubectl output wrapped in this error","Fix the manifest field that the API server rejected (immutable fields, unknown fields, missing CRD)","Ensure the referenced CRDs/addons are installed before applying this manifest","Verify kubectl is in PATH and the current kubeconfig context points at the target cluster with sufficient RBAC","Upgrade kubectl to a version matching the cluster if --server-side flags are unsupported"],"exampleFix":"// before\napiVersion: v1\nkind: Service\nspec:\n  clusterIP: 10.0.0.5  # changing immutable clusterIP makes apply fail\n// after\napiVersion: v1\nkind: Service\nspec:\n  # omit clusterIP so server-side apply does not fight the API server\n  ports:\n  - port: 80","handlingStrategy":"try-catch","validationCode":"// Go: pre-flight before calling Apply\nif _, err := exec.LookPath(\"kubectl\"); err != nil {\n    return fmt.Errorf(\"kubectl not in PATH: %w\", err)\n}\nif err := clientset.Discovery().ServerVersion(); err != nil {\n    return fmt.Errorf(\"cluster unreachable: %w\", err)\n}\n// dry-run the manifest first\nif out, err := exec.Command(\"kubectl\", \"apply\", \"-f\", manifestPath, \"--dry-run=server\").CombinedOutput(); err != nil {\n    return fmt.Errorf(\"manifest rejected: %s\", out)\n}","typeGuard":null,"tryCatchPattern":"if err := applier.Apply(ctx, data); err != nil {\n    var outer interface{ Unwrap() error }\n    klog.Errorf(\"addon apply failed: %v\", err) // kubectl stderr is logged by klog in execKubectl\n    return fmt.Errorf(\"addon %s apply failed: %w\", addonName, err)\n}","preventionTips":["Ensure the target CRDs are installed before applying addon manifests","Never change immutable fields (clusterIP, nodePort) in addon updates","Pin a kubectl version that supports --server-side and matches the cluster","Keep the kubeconfig context and RBAC (cluster-admin for kops) verified in CI"],"tags":["kubectl","server-side-apply","kubernetes","addon"],"backgroundTag":"kubectl-apply-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}