{"record":{"id":"90fa441f16315bbc","repo":"microsoft/aspire","slug":"kubectl-apply-for-clusterissuer-issuer-name-failed-with-exit","errorCode":null,"errorMessage":"kubectl apply for ClusterIssuer '{issuer.Name}' failed with exit code {result.ExitCode}: {errOut}","messagePattern":"kubectl apply for ClusterIssuer '(.+?)' failed with exit code (.+?): (.+?)","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Kubernetes/CertManagerExtensions.cs","lineNumber":482,"sourceCode":"            {\n                Arguments = args.ToString(),\n                ThrowOnNonZeroReturnCode = false,\n                InheritEnv = true,\n                OnOutputData = line => context.Logger.LogDebug(\"kubectl: {Line}\", line),\n                OnErrorData = line =>\n                {\n                    stderr.AppendLine(line);\n                    context.Logger.LogDebug(\"kubectl: {Line}\", line);\n                }\n            });\n\n            await using (disposable.ConfigureAwait(false))\n            {\n                var result = await resultTask.WaitAsync(context.CancellationToken).ConfigureAwait(false);\n                if (result.ExitCode != 0)\n                {\n                    var errOut = stderr.ToString().Trim();\n                    throw new InvalidOperationException(\n                        $\"kubectl apply for ClusterIssuer '{issuer.Name}' failed with exit code {result.ExitCode}: {errOut}\");\n                }\n            }\n\n            context.Logger.LogInformation(\"ClusterIssuer '{IssuerName}' applied.\", issuer.Name);\n        }\n        finally\n        {\n            try { tempDir.Delete(recursive: true); }\n            catch (IOException) { /* best-effort cleanup */ }\n            catch (UnauthorizedAccessException) { /* best-effort cleanup */ }\n        }\n    }\n\n    private static async Task DeleteClusterIssuerAsync(\n        PipelineStepContext context,\n        CertManagerResource certManager,\n        CertManagerIssuerResource issuer)","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Kubernetes/CertManagerExtensions.cs#L464-L500","documentation":"ApplyClusterIssuerAsync shells out to 'kubectl apply' to create the ClusterIssuer. If the kubectl process exits with a non-zero exit code, the publisher throws InvalidOperationException including the exit code and kubectl's stderr output so the underlying cluster/API-server error is visible.","triggerScenarios":"kubectl apply exits non-zero — e.g. kubeconfig missing/invalid, cluster unreachable, RBAC denied, manifest rejected by admission webhooks, or kubectl not able to reach the API server.","commonSituations":"Expired credentials in kubeconfig, wrong context selected, cert-manager CRDs not installed in the target cluster, or network/VPN preventing cluster access.","solutions":["Read the errOut detail in the message and fix the underlying kubectl failure (auth, connectivity, CRDs).","Run 'kubectl cluster-info' and 'kubectl auth can-i create clusterissuers.cert-manager.io' locally to verify access.","Ensure cert-manager CRDs are installed in the target cluster before publishing.","Confirm the correct kubeconfig context is selected for the target environment."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight\nkubectl cluster-info && kubectl auth can-i create clusterissuers.cert-manager.io","typeGuard":null,"tryCatchPattern":"try { await publishAsync(); }\ncatch (InvalidOperationException ex) when (ex.Message.StartsWith(\"kubectl apply for ClusterIssuer\")) { logger.LogError(ex, \"kubectl apply failed; check kubeconfig/CRDs/RBAC\"); throw; }","preventionTips":["Verify kubeconfig context and credentials before publishing.","Install cert-manager CRDs in the target cluster ahead of time.","Check cluster reachability (VPN/network) before running publish."],"tags":["kubernetes","kubectl","cert-manager","publish","process-exit-code"],"backgroundTag":"command-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}