{"record":{"id":"8f00210b212dfbfa","repo":"GoogleContainerTools/skaffold","slug":"patching-resource-s-q-w","errorCode":null,"errorMessage":"patching resource %s/%q: %w","messagePattern":"patching resource (.+?)/%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/deploy/label/labels.go","lineNumber":121,"sourceCode":"\t\treturn fmt.Errorf(\"getting group version resource from obj: %w\", err)\n\t}\n\n\tif namespaced {\n\t\tvar namespace string\n\t\tif accessor.GetNamespace() != \"\" {\n\t\t\tnamespace = accessor.GetNamespace()\n\t\t} else {\n\t\t\tnamespace = res.Namespace\n\t\t}\n\n\t\tns, err := resolveNamespace(namespace, kubeContext)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"resolving namespace: %w\", err)\n\t\t}\n\n\t\tlog.Entry(ctx).Debug(\"Patching\", name, \"in namespace\", ns)\n\t\tif _, err := client.Resource(gvr).Namespace(ns).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"patching resource %s/%q: %w\", ns, name, err)\n\t\t}\n\t} else {\n\t\tlog.Entry(ctx).Debug(\"Patching\", name)\n\t\tif _, err := client.Resource(gvr).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {\n\t\t\treturn fmt.Errorf(\"patching resource %q: %w\", name, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc resolveNamespace(ns, kubeContext string) (string, error) {\n\tif ns != \"\" {\n\t\treturn ns, nil\n\t}\n\tcfg, err := kubectx.CurrentConfig()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"getting kubeconfig: %w\", err)","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/deploy/label/labels.go#L103-L139","documentation":"After computing a strategic merge patch carrying the skaffold labels, the namespaced resource is patched through the dynamic client's Resource(gvr).Namespace(ns).Patch. This error wraps any API server rejection or transport failure during that patch call.","triggerScenarios":"Patch request against a namespaced resource fails: 404 (object gone), 403 (RBAC denies patch), 409/422 (conflict or schema validation), network timeout, or wrong namespace so the object doesn't exist there.","commonSituations":"ServiceAccount lacks patch permission (RBAC in CI); resource deleted between deploy and label; namespace mismatch between manifest and kubeconfig default; API server briefly unreachable.","solutions":["Check RBAC: `kubectl auth can-i patch <resource> -n <ns>` — bind a role with patch permission if denied","Confirm the resource exists in the resolved namespace: `kubectl get <resource> -n <ns>`","Verify cluster connectivity and API server health (`kubectl cluster-info`)","Rerun the deploy — transient network errors during labeling resolve on retry"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight RBAC check\nallowed, err := authClient.SelfSubjectAccessReviews().Create(ctx,\n    &authv1.SelfSubjectAccessReview{Spec: authv1.SelfSubjectAccessReviewSpec{\n        ResourceAttributes: &authv1.ResourceAttributes{Verb: \"patch\", Resource: resource, Namespace: ns}}})\n// allowed.Status.Allowed must be true","typeGuard":null,"tryCatchPattern":"if _, err := client.Resource(gvr).Namespace(ns).Patch(ctx, name, types.StrategicMergePatchType, p, metav1.PatchOptions{}); err != nil {\n    if apierrors.IsNotFound(err) { return nil } // object gone, skip labeling\n    if apierrors.IsForbidden(err) { return fmt.Errorf(\"RBAC: cannot patch %s/%s: %w\", ns, name, err) }\n    return retryable(err)\n}","preventionTips":["Grant patch RBAC to CI ServiceAccounts","Check kubectl auth can-i patch before pipelines","Keep the resource alive between deploy and label steps","Handle transient API server errors with backoff"],"tags":["kubernetes","patch","rbac","api-server"],"backgroundTag":"kubernetes-patch-forbidden","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}