{"record":{"id":"eee814abe294bf78","repo":"kubernetes/kops","slug":"failed-to-set-object-w","errorCode":null,"errorMessage":"failed to set object: %w","messagePattern":"failed to set object: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/components/addonmanifests/remap.go","lineNumber":110,"sourceCode":"\n\t\tif err := object.Reparse(podSpec, \"spec\", \"template\", \"spec\"); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to parse spec.template.spec from Deployment: %v\", err)\n\t\t}\n\t\tsa := types.NamespacedName{\n\t\t\tName:      podSpec.ServiceAccountName,\n\t\t\tNamespace: object.GetNamespace(),\n\t\t}\n\t\tsubject := serviceAccounts[sa]\n\t\tif subject == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\tif err := iam.AddServiceAccountRole(&context.IAMModelContext, podSpec, subject); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif err := object.Set(podSpec, \"spec\", \"template\", \"spec\"); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set object: %w\", err)\n\t\t}\n\n\t}\n\treturn nil\n}\n\nfunc addLabels(addon *addonsapi.AddonSpec, objects kubemanifest.ObjectList) error {\n\tfor _, object := range objects {\n\t\tmeta := &metav1.ObjectMeta{}\n\t\terr := object.Reparse(meta, \"metadata\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to annotate %T\", object)\n\t\t}\n\n\t\tif meta.Labels == nil {\n\t\t\tmeta.Labels = make(map[string]string)\n\t\t}\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/components/addonmanifests/remap.go#L92-L128","documentation":"After injecting the IAM service-account role into the parsed PodSpec, addServiceAccountRole writes it back with object.Set(podSpec, \"spec\",\"template\",\"spec\"). If marshalling/patching the modified PodSpec back into the object fails, this wrapped error is returned — usually a serialization issue rather than a logic problem.","triggerScenarios":"addServiceAccountRole call where iam.AddServiceAccountRole succeeded (volumes/env added for IRSA) but object.Set fails to serialize the PodSpec back into the manifest object (e.g. incompatible structure at that path).","commonSituations":"Very rare; seen when the manifest object's internal representation diverges from a standard apps/v1 workload structure, or kubemanifest version mismatches; nearly always indicates a corrupt or non-standard manifest.","solutions":["Inspect the wrapped %w error for the marshal/set failure detail","Restore the stock addon manifest matching the kops version","Ensure the object is a standard apps/v1 Deployment/DaemonSet with a normal spec.template.spec","Upgrade kops if the kubemanifest round-trip bug is fixed upstream"],"exampleFix":"// no user-side code fix; replace the non-standard object\n// before: kind: Deployment with apiVersion: extensions/v1beta1 remapped in-place\n// after: apiVersion: apps/v1 kind: Deployment with spec.template.spec","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func canRoundTripPodSpec(obj *kubemanifest.Object) bool {\n    var podSpec corev1.PodSpec\n    if err := obj.Reparse(&podSpec, \"spec\", \"template\", \"spec\"); err != nil { return false }\n    return obj.Set(&podSpec, \"spec\", \"template\", \"spec\") == nil\n}","tryCatchPattern":"if err := object.Set(podSpec, \"spec\", \"template\", \"spec\"); err != nil {\n    return fmt.Errorf(\"failed to set object: %w\", err)\n}","preventionTips":["Use only standard apps/v1 workload structures in addon manifests","Round-trip test custom manifests (load + save) before cluster updates","Keep kops and channel manifests version-aligned"],"tags":["kops","podspec","manifest-writing","addon"],"backgroundTag":"podspec-writeback-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}