{"record":{"id":"f1d3ca0a84521279","repo":"derailed/k9s","slug":"unable-to-set-image-this-pod-is-managed-by-s-pl","errorCode":null,"errorMessage":"unable to set image. This pod is managed by %s. Please set the image on the controller","messagePattern":"unable to set image\\. This pod is managed by (.+?)\\. Please set the image on the controller","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/dao/pod.go","lineNumber":570,"sourceCode":"\treturn &podSpec, nil\n}\n\n// SetImages sets container images.\nfunc (p *Pod) SetImages(ctx context.Context, path string, imageSpecs ImageSpecs) error {\n\tns, n := client.Namespaced(path)\n\tauth, err := p.Client().CanI(ns, p.gvr, n, client.PatchAccess)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !auth {\n\t\treturn fmt.Errorf(\"user is not authorized to patch a deployment\")\n\t}\n\tmanager, isManaged, err := p.isControlled(path)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif isManaged {\n\t\treturn fmt.Errorf(\"unable to set image. This pod is managed by %s. Please set the image on the controller\", manager)\n\t}\n\tjsonPatch, err := GetJsonPatch(imageSpecs)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdial, err := p.Client().Dial()\n\tif err != nil {\n\t\treturn err\n\t}\n\t_, err = dial.CoreV1().Pods(ns).Patch(\n\t\tctx,\n\t\tn,\n\t\ttypes.StrategicMergePatchType,\n\t\tjsonPatch,\n\t\tmetav1.PatchOptions{},\n\t)\n\n\treturn err","sourceCodeStart":552,"sourceCodeEnd":588,"githubUrl":"https://github.com/derailed/k9s/blob/2d3ccc6ba2ce98c3781bfc441bb3e884f072774f/internal/dao/pod.go#L552-L588","documentation":"Before patching images, SetImages inspects ownerReferences for a controller=true entry. Pods created by Deployments/StatefulSets/DaemonSets/Jobs are managed: any image patch on the pod is reverted by the controller on the next reconcile, so the DAO refuses and names the managing object.","triggerScenarios":"Calling SetImages on any pod whose metadata.ownerReferences contains a controller (manager reported as e.g. replicaset/my-rs).","commonSituations":"Trying to hot-swap an image on a Deployment-owned pod instead of the Deployment; users hitting set-image on workload-managed pods in k9s; debugging attempts that would be silently undone.","solutions":["Set the image on the controlling workload: kubectl set image deployment/<d> <container>=<image> (likewise statefulsets/daemonsets)","For throwaway debugging, patch the controller or attach an ephemeral container instead of patching the pod","If the pod must be truly standalone, recreate it without a controller ownerReference"],"exampleFix":"# before\nk9s: set image on pod my-deploy-7d9c4f6b5-x2kzv  (rejected)\n\n# after\nkubectl set image deployment/my-deploy app=nginx:1.27 -n my-ns","handlingStrategy":"type-guard","validationCode":"pod, err := podDAO.GetInstance(fqn)\nif err != nil { return err }\nif mgr, ok := controllerOf(pod); ok {\n    return fmt.Errorf(\"set image on %s instead\", mgr)\n}","typeGuard":"func controllerOf(p *v1.Pod) (string, bool) {\n    for _, ref := range p.GetOwnerReferences() {\n        if ref.Controller != nil && *ref.Controller {\n            return ref.Kind + \"/\" + ref.Name, true\n        }\n    }\n    return \"\", false\n}","tryCatchPattern":"if err := podDAO.SetImages(ctx, path, specs); err != nil {\n    if strings.Contains(err.Error(), \"managed by\") {\n        // extract manager from message and redirect the patch to that controller\n    }\n}","preventionTips":["Check ownerReferences before offering pod-level image mutations in UIs","Route image changes to Deployments/StatefulSets/DaemonSets by reflex","For debugging pods without touching controllers, prefer kubectl debug ephemeral containers"],"tags":["kubernetes","pod","owner-reference","image","controller"],"backgroundTag":null,"analyzedSha":"2d3ccc6ba2ce98c3781bfc441bb3e884f072774f","analyzedAt":"2026-08-15T16:09:14.432Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}