{"record":{"id":"73bfa84e106ea804","repo":"kubernetes/kops","slug":"failed-to-patch-object-managed-fields-for-q-w","errorCode":null,"errorMessage":"failed to patch object managed-fields for %q: %w","messagePattern":"failed to patch object managed-fields for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/applylib/applyset/managedfields.go","lineNumber":50,"sourceCode":"// ManagedFieldsMigrator manages the migration of field managers from client-side managers to the server-side manager.\ntype ManagedFieldsMigrator struct {\n\tClient     *UnstructuredClient\n\tNewManager string\n}\n\n// Migrate migrates from client-side field managers to the NewManager (with an Apply operation).\n// This is needed to move from client-side apply to server-side apply.\nfunc (m *ManagedFieldsMigrator) Migrate(ctx context.Context, obj *unstructured.Unstructured) error {\n\tmanagedFieldPatch, err := m.createManagedFieldPatch(obj)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create managed-fields patch: %w\", err)\n\t}\n\tif managedFieldPatch != nil {\n\t\tgvk := obj.GroupVersionKind()\n\t\tnn := types.NamespacedName{Namespace: obj.GetNamespace(), Name: obj.GetName()}\n\t\t_, err := m.Client.Patch(ctx, gvk, nn, types.MergePatchType, managedFieldPatch, metav1.PatchOptions{})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to patch object managed-fields for %q: %w\", obj.GetName(), err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// createManagedFieldPatch constructs a patch to combine managed fields.\n// It returns nil if no patch is needed.\nfunc (m *ManagedFieldsMigrator) createManagedFieldPatch(currentObject *unstructured.Unstructured) ([]byte, error) {\n\tif currentObject == nil {\n\t\treturn nil, nil\n\t}\n\tneedPatch := false\n\tfixedManagedFields := []metav1.ManagedFieldsEntry{}\n\tfor _, managedField := range currentObject.GetManagedFields() {\n\t\tfixedManagedField := managedField.DeepCopy()\n\t\tif managedField.Manager == \"kubectl-edit\" || managedField.Manager == \"kubectl-client-side-apply\" {\n\t\t\tneedPatch = true\n\t\t\tfixedManagedField.Manager = m.NewManager","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/applylib/applyset/managedfields.go#L32-L68","documentation":"After building the managed-fields merge patch, Migrate PATCHes the object with types.MergePatchType. If the API server rejects or cannot perform that patch, the error is wrapped as \"failed to patch object managed-fields for %q\" with the object name. The migration for that object is aborted; apply-side callers treat this as a hard error.","triggerScenarios":"The MergePatchType PATCH to update metadata.managedFields fails: RBAC denial (patch permission missing on the resource), object changed/deleted concurrently (conflict), resource doesn't exist yet, or the API server rejects the merge patch payload.","commonSituations":"Running migration with a service account lacking patch rights; object deleted by a controller mid-migration; applying migration during a rolling update when objects are being recreated.","solutions":["Check RBAC: grant patch/update on the target resource to the identity used by the migrator.","Re-run the migration after the object settles — conflicts from concurrent modification are transient.","Verify the object exists and its GVK resolves on the cluster before migrating (see error 769 for mapping failures)."],"exampleFix":"# before\nrules:\n- apiGroups: [\"*\"]\n  resources: [\"*\"]\n  verbs: [\"get\", \"list\", \"watch\"]\n# after\nrules:\n- apiGroups: [\"*\"]\n  resources: [\"*\"]\n  verbs: [\"get\", \"list\", \"watch\", \"patch\", \"update\"]","handlingStrategy":"retry","validationCode":"// ensure patch RBAC before migrating\nerr := authClient.SelfSubjectAccessReviews.Create(ctx, &authorizationv1.SelfSubjectAccessReview{\n    Spec: authorizationv1.SelfSubjectAccessReviewSpec{\n        ResourceAttributes: &authorizationv1.ResourceAttributes{Verb: \"patch\", Resource: resource},\n    },\n})","typeGuard":null,"tryCatchPattern":"if err := migrator.Migrate(ctx, obj); err != nil {\n    if apierrors.IsConflict(err) || apierrors.IsNotFound(err) {\n        time.Sleep(backoff)\n        return migrator.Migrate(ctx, obj) // object settled; retry\n    }\n    return err\n}","preventionTips":["Grant patch permission on all migrated resource types to the migration identity.","Avoid migrating during rolling updates when objects are being recreated.","Retry transient conflicts with backoff; migration is idempotent."],"tags":["kubernetes","managed-fields","patch","migration"],"backgroundTag":"managed-fields-migration-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}