{"record":{"id":"7ada03c0abbabf66","repo":"kubernetes/kops","slug":"error-applying-patch-to-node-v","errorCode":null,"errorMessage":"error applying patch to node: %v","messagePattern":"error applying patch to node: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/controllers/node_controller.go","lineNumber":168,"sourceCode":"\t\tnodePatchMetadata.Labels[k] = &v\n\t}\n\tfor k := range deleteLabels {\n\t\tnodePatchMetadata.Labels[k] = nil\n\t}\n\n\tnodePatch := &nodePatch{\n\t\tMetadata: nodePatchMetadata,\n\t}\n\tnodePatchJson, err := json.Marshal(nodePatch)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error building node patch: %v\", err)\n\t}\n\n\tklog.V(2).Infof(\"sending patch for node %q: %q\", node.Name, string(nodePatchJson))\n\n\t_, err = client.Nodes().Patch(ctx, node.Name, types.StrategicMergePatchType, nodePatchJson, metav1.PatchOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error applying patch to node: %v\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":150,"sourceCodeEnd":173,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/controllers/node_controller.go#L150-L173","documentation":"patchNodeLabels sends the marshaled strategic-merge patch to the Node object; this wraps the Nodes().Patch API call failing, e.g. concurrent node modification (conflict), RBAC denial, or the node having been deleted mid-reconcile.","triggerScenarios":"The Patch request fails — HTTP 409 conflict (Node updated concurrently / resourceVersion change), 404 (Node deleted), 401/403 (RBAC denies nodes/status patch), or transient network/server errors.","commonSituations":"kops-controller ServiceAccount lacking patch permission on nodes, node deleted during reconciliation (common with autoscaling churn), heavy concurrent label updates (conflict), or API server temporarily unreachable.","solutions":["Inspect the wrapped error for the HTTP status/reason","Check RBAC: kops-controller needs 'patch' on nodes","If conflict (409), rely on controller-runtime requeue — it retries automatically","If 404, the node is gone; treat as benign","Verify API server connectivity from the controller pod"],"exampleFix":"// before\n_, err = client.Nodes().Patch(ctx, node.Name, types.StrategicMergePatchType, nodePatchJson, metav1.PatchOptions{})\n// after: retry on conflict handled by controller-runtime — ensure Requeue is returned\nif apierrors.IsConflict(err) {\n\treturn ctrl.Result{Requeue: true}, nil\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err = client.Nodes().Patch(ctx, node.Name, types.StrategicMergePatchType, nodePatchJson, metav1.PatchOptions{})\nif err != nil {\n\tif apierrors.IsConflict(err) || apierrors.IsNotFound(err) {\n\t\treturn nil // requeue/skip: benign\n\t}\n\treturn fmt.Errorf(\"error applying patch to node: %v\", err)\n}\n","preventionTips":["Grant patch RBAC on nodes to kops-controller","Treat conflict/not-found as retryable rather than fatal","Return Requeue so controller-runtime retries conflicts"],"tags":["kubernetes","rbac","patch","node-controller"],"backgroundTag":"kubernetes-api-patch-rejected","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}