{"record":{"id":"ca55d8c454415958","repo":"kubernetes/kops","slug":"applying-kubeconfig-secret-to-cluster-w","errorCode":null,"errorMessage":"applying kubeconfig secret to cluster: %w","messagePattern":"applying kubeconfig secret to cluster: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/controllers/clusterapi/cluster_controller.go","lineNumber":315,"sourceCode":"\t\t\t},\n\t\t\t\"data\": map[string]any{\n\t\t\t\t\"value\": kubeconfigBytes,\n\t\t\t},\n\t\t\t\"type\": \"Opaque\",\n\t\t}\n\n\t\tu := &unstructured.Unstructured{Object: obj}\n\n\t\t// Needed so that capi manager has \"permission\" to read the secret\n\t\tlabels := map[string]string{\n\t\t\t\"cluster.x-k8s.io/cluster-name\": name,\n\t\t}\n\n\t\tu.SetLabels(labels)\n\n\t\tsetOwnerRef(u, s.Cluster)\n\t\tif err := s.ssa(ctx, kube, u); err != nil {\n\t\t\treturn fmt.Errorf(\"applying kubeconfig secret to cluster: %w\", err)\n\t\t}\n\t}\n\n\t// TODO: Sync with LinkToNetwork\n\tobj := map[string]any{\n\t\t\"apiVersion\": \"controlplane.cluster.x-k8s.io/v1beta1\",\n\t\t\"kind\":       \"KopsControlPlane\",\n\t\t\"metadata\": map[string]any{\n\t\t\t\"name\":      name,\n\t\t\t\"namespace\": s.namespace(),\n\t\t},\n\t\t\"spec\": map[string]any{},\n\t}\n\n\tu := &unstructured.Unstructured{Object: obj}\n\n\t// setOwnerRef(u, s.Cluster)\n","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/controllers/clusterapi/cluster_controller.go#L297-L333","documentation":"The kubeconfig Secret (named <cluster>-kubeconfig in kube-system) is applied to the target cluster via server-side apply (ssa). This error wraps any failure of that Patch call, meaning the API server rejected or could not process the apply — e.g. permissions, conflict, validation, or connectivity problems.","triggerScenarios":"The controller's ServiceAccount lacks create/patch RBAC on Secrets in kube-system; another field manager conflicts on the object; the API server is unreachable; the Secret fails server-side-apply validation; namespace kube-system does not exist (wrong kube context).","commonSituations":"Installing the clusterapi controllers with an incomplete RBAC manifest; applying against the wrong cluster/context; concurrent controllers with different field owners fighting over the secret.","solutions":["Grant the controller RBAC: get/create/update/patch on secrets in kube-system (check +kubebuilder:rbac markers and generated role)","Confirm the kube client points at the intended cluster (KUBECONFIG / in-cluster config)","Inspect the wrapped error: Forbidden → RBAC, Conflict → field-manager conflict, Timeout → connectivity","If a conflicting field manager exists, remove stale managers or adopt the field owner 'cluster-controller'"],"exampleFix":"# before: missing RBAC\n# (no secrets rule in the controller role)\n# after: add to the controller ClusterRole\nrules:\n- apiGroups: [\"\"]\n  resources: [\"secrets\"]\n  verbs: [\"get\", \"list\", \"watch\", \"create\", \"update\", \"patch\", \"delete\"]","handlingStrategy":"validation","validationCode":"// verify RBAC before rollout\nkubectl auth can-i patch secrets -n kube-system \\\n  --as=system:serviceaccount:<ns>:<controller-sa>","typeGuard":null,"tryCatchPattern":"if err := s.ssa(ctx, kube, u); err != nil {\n    if apierrors.IsForbidden(err) {\n        klog.Errorf(\"RBAC denies secret apply: %v\", err)\n    }\n    return fmt.Errorf(\"applying kubeconfig secret to cluster: %w\", err)\n}","preventionTips":["Run kubectl auth can-i checks for the controller SA on secrets before deploying","Confirm the target kube context is the intended management cluster","Use a consistent field owner for all applies","Monitor for field-manager conflicts if multiple controllers manage the secret"],"tags":["kubernetes","rbac","server-side-apply","secret"],"backgroundTag":"server-side-apply-rejected","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}