{"record":{"id":"6bdcebc284fb24ee","repo":"derailed/k9s","slug":"user-is-not-authorized-to-patch-a-deployment","errorCode":null,"errorMessage":"user is not authorized to patch a deployment","messagePattern":"user is not authorized to patch a deployment","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/dao/dp.go","lineNumber":208,"sourceCode":"// GetPodSpec returns a pod spec given a resource.\nfunc (d *Deployment) GetPodSpec(path string) (*v1.PodSpec, error) {\n\tdp, err := d.GetInstance(path)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpodSpec := dp.Spec.Template.Spec\n\treturn &podSpec, nil\n}\n\n// SetImages sets container images.\nfunc (d *Deployment) SetImages(ctx context.Context, path string, imageSpecs ImageSpecs) error {\n\tns, n := client.Namespaced(path)\n\tauth, err := d.Client().CanI(ns, d.gvr, n, client.PatchAccess)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !auth {\n\t\treturn fmt.Errorf(\"user is not authorized to patch a deployment\")\n\t}\n\tjsonPatch, err := GetTemplateJsonPatch(imageSpecs)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdial, err := d.Client().Dial()\n\tif err != nil {\n\t\treturn err\n\t}\n\t_, err = dial.AppsV1().Deployments(ns).Patch(\n\t\tctx,\n\t\tn,\n\t\ttypes.StrategicMergePatchType,\n\t\tjsonPatch,\n\t\tmetav1.PatchOptions{},\n\t)\n\treturn err\n}","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/derailed/k9s/blob/2d3ccc6ba2ce98c3781bfc441bb3e884f072774f/internal/dao/dp.go#L190-L226","documentation":"Deployment.SetImages (internal/dao/dp.go:205-217) applies a JSON patch to a Deployment's pod template to swap container images. It first requires the patch verb on deployments.apps in the namespace (client.PatchAccess via CanI); denial returns this error before building the patch.","triggerScenarios":"Using k9s's set-image action on a Deployment while the current identity lacks `patch deployments` in that namespace. Only the patch verb is checked; having update alone will still fail this pre-check.","commonSituations":"Developer roles granted update but not patch; GitOps-managed clusters where mutation via kubectl/k9s is intentionally blocked; wrong context selected in k9s.","solutions":["Verify: kubectl auth can-i patch deployments -n <ns>","Add verbs: [\"patch\"] for deployments.apps in the Role, or use update-capable workflows the role already has","Prefer the GitOps pipeline for image changes if mutation is intentionally locked down"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-flight patch permission for the set-image action.\nfunc CanSetImage(c client.Client, ns string) (bool, error) {\n\treturn c.CanI(ns, client.DpGVR, \"\", client.PatchAccess)\n}","typeGuard":null,"tryCatchPattern":"if err := d.SetImages(ctx, path, specs); err != nil {\n    if strings.Contains(err.Error(), \"not authorized to patch a deployment\") {\n        return fmt.Errorf(\"RBAC: add verbs:[patch] on deployments.apps in namespace %s\", ns)\n    }\n    return err\n}","preventionTips":["Roles that own rollouts need patch, not just update, on deployments.apps","Hide/disable set-image in shared k9s skins for view-only users"],"tags":["go","kubernetes","rbac","k9s","deployment","image","authorization"],"backgroundTag":null,"analyzedSha":"2d3ccc6ba2ce98c3781bfc441bb3e884f072774f","analyzedAt":"2026-08-15T16:09:14.432Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}