{"record":{"id":"5b9b42003cf38b03","repo":"kubernetes/kops","slug":"lifecycle-set-to-existsandvalidates-but-object-di","errorCode":null,"errorMessage":"lifecycle set to ExistsAndValidates, but object did not match","messagePattern":"lifecycle set to ExistsAndValidates, but object did not match","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/context.go","lineNumber":182,"sourceCode":"\t\t\t\ttaskName := getTaskName(e)\n\t\t\t\tfmt.Fprintf(b, \"Object from different phase did not match, problems possible:\\n\")\n\t\t\t\tfmt.Fprintf(b, \"  %s/%s\\n\", taskName, \"?\")\n\t\t\t\tfor _, change := range changeList {\n\t\t\t\t\tlines := strings.Split(change.Description, \"\\n\")\n\t\t\t\t\tif len(lines) == 1 {\n\t\t\t\t\t\tfmt.Fprintf(b, \"  \\t%-20s\\t%s\\n\", change.FieldName, change.Description)\n\t\t\t\t\t} else {\n\t\t\t\t\t\tfmt.Fprintf(b, \"  \\t%-20s\\n\", change.FieldName)\n\t\t\t\t\t\tfor _, line := range lines {\n\t\t\t\t\t\t\tfmt.Fprintf(b, \"  \\t%-20s\\t%s\\n\", \"\", line)\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tfmt.Fprintf(b, \"\\n\")\n\t\t\t\tb.WriteTo(out)\n\n\t\t\t\tif lifecycle == LifecycleExistsAndValidates {\n\t\t\t\t\treturn fmt.Errorf(\"lifecycle set to ExistsAndValidates, but object did not match\")\n\t\t\t\t}\n\t\t\t\t// Warn, but then we continue\n\t\t\t\treturn nil\n\t\t\t}\n\t\t}\n\t}\n\n\tif _, ok := c.Target.(*DryRunTarget[T]); ok {\n\t\treturn c.Target.(*DryRunTarget[T]).Render(a, e, changes)\n\t}\n\n\tv := reflect.ValueOf(e)\n\tvType := v.Type()\n\n\ttargetType := reflect.ValueOf(c.Target).Type()\n\n\t// Probe renderers with literal method names only: enumerating the method set or passing a\n\t// variable name to MethodByName would disable linker pruning of every unused exported method.","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/context.go#L164-L200","documentation":"With lifecycle ExistsAndValidates, if the actual object exists but its fields differ from desired, Render builds a change list, prints the diffs to stderr, and then fails with this error — the assertion is that the object exists AND is unchanged. ExistsAndWarnIfChanges is the lenient variant that only warns.","triggerScenarios":"A task rendered with lifecycle ExistsAndValidates where buildChangeList reports non-empty differences — e.g. an IAM policy, security group rule, or ASG was modified out-of-band — during phased updates (`kops update cluster --phase ...`) or --lifecycle-existence-checks runs.","commonSituations":"Manual console edits to cloud resources (tag changes, instance-type tweaks) between kops runs; kops version upgrade changing generated spec fields; another automation tool mutating the same resource; strict CI validation of cluster drift.","solutions":["Revert the out-of-band change so the object matches the kops manifest, then re-run.","Run `kops update cluster` with the default lifecycle to apply the desired state, then re-run the ExistsAndValidates check.","Review the printed field-by-field diff on stderr to see exactly which fields drifted."],"exampleFix":"# before (object drifted)\nkops update cluster <name> --lifecycle-existence-checks  # fails\n# after\nkops update cluster <name>   # apply desired state\nkops update cluster <name> --lifecycle-existence-checks  # now passes","handlingStrategy":"validation","validationCode":"// pre-run drift check\nout, _ := exec.Command(\"kops\", \"update\", \"cluster\", name, \"--dry-run\").Output()\nif strings.Contains(string(out), \"did not match\") { reconcileFirst() }","typeGuard":null,"tryCatchPattern":"err := kopsUpdate(...)\nif err != nil && strings.Contains(err.Error(), \"ExistsAndValidates, but object did not match\") {\n    klog.Errorf(\"drift detected, review stderr diff: %v\", err)\n}","preventionTips":["Treat kops-managed resources as immutable outside kops.","Re-run `kops update cluster` after kops upgrades to absorb generated-spec changes.","Read the stderr field diff Render prints to locate drifted fields quickly."],"tags":["lifecycle","drift","task-engine","exists-and-validates"],"backgroundTag":"lifecycle-existence-assertion-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}