{"record":{"id":"8e05dd8cb0fd3230","repo":"kubernetes/kops","slug":"error-from-apply-w","errorCode":null,"errorMessage":"error from apply: %w","messagePattern":"error from apply: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/applylib/applyset/applyset.go","lineNumber":150,"sourceCode":"\t\t\t\tNewManager: \"kops\",\n\t\t\t\tClient:     client,\n\t\t\t}\n\t\t\tif err := managedFields.Migrate(ctx, currentObj); err != nil {\n\t\t\t\tresults.applyError(gvk, nn, err)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\n\t\tj, err := json.Marshal(expectedObject)\n\t\tif err != nil {\n\t\t\t// TODO: Differentiate between server-fixable vs client-fixable errors?\n\t\t\tresults.applyError(gvk, nn, fmt.Errorf(\"failed to marshal object to JSON: %w\", err))\n\t\t\tcontinue\n\t\t}\n\n\t\tlastApplied, err := client.Patch(ctx, gvk, nn, types.ApplyPatchType, j, a.patchOptions)\n\t\tif err != nil {\n\t\t\tresults.applyError(gvk, nn, fmt.Errorf(\"error from apply: %w\", err))\n\t\t\tcontinue\n\t\t}\n\n\t\ttracker.lastApplied = lastApplied\n\t\tresults.applySuccess(gvk, nn)\n\t\ttracker.isHealthy = isHealthy(lastApplied)\n\t\tresults.reportHealth(gvk, nn, tracker.isHealthy)\n\t}\n\treturn results, nil\n}\n","sourceCodeStart":132,"sourceCodeEnd":161,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/applylib/applyset/applyset.go#L132-L161","documentation":"ApplyOnce applies each expected object with client.Patch using types.ApplyPatchType (server-side apply). Any failure returned by the API server during that patch is wrapped as \"error from apply: %w\" and recorded for that object; the loop continues to the next object. The wrapped error is the API server's response, so the root cause lives inside the %w.","triggerScenarios":"Server-side apply PATCH to the API server fails: conflicts with another field manager (Apply failed with conflicts), schema validation rejection, RBAC denial, connection errors, or the resource/GVK not existing on the server.","commonSituations":"Another controller owns fields with a different fieldManager and force is disabled; applying a CRD-backed resource before its CRD exists; the user's kubeconfig lacks permission on the target resource; kube-apiserver temporarily unreachable during cluster bring-up.","solutions":["Read the wrapped error: for field-manager conflicts, re-apply with Force=true (patchOptions{FieldManager, Force}) or adopt/adjust the conflicting manager.","Ensure CRDs are applied before CRs — order expectedObjects so CRDs come first, or run apply twice.","Verify RBAC and kubeconfig connectivity to the target cluster (kubectl auth cani / kubectl get <resource>).","Retry the apply; applyset is designed to converge, so transient API errors often resolve on a subsequent run."],"exampleFix":"// before\na := &Applyset{patchOptions: metav1.PatchOptions{FieldManager: \"kops\"}}\n// after\na := &Applyset{patchOptions: metav1.PatchOptions{FieldManager: \"kops\", Force: ptr.To(true)}}","handlingStrategy":"retry","validationCode":"// preflight: ensure resource exists and caller can patch\nmapping, err := restMapper.RESTMapping(gvk.GroupKind(), gvk.Version)\nif err != nil { return err }\n_ = mapping","typeGuard":null,"tryCatchPattern":"err := applyset.ApplyOnce(ctx)\nif err != nil {\n    var apiErr *apierrors.StatusError\n    if errors.As(err, &apiErr) && apierrors.IsConflict(err) {\n        // enable Force or re-run apply to converge\n    }\n}","preventionTips":["Set a dedicated FieldManager and use Force=true when you own the objects.","Order applies: CRDs/namespaces before dependent resources; run apply until convergence.","Verify RBAC (patch/update verbs) for the applying identity before rollout."],"tags":["kubernetes","server-side-apply","api-server","patch"],"backgroundTag":"server-side-apply-conflict","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}