helm/helm · error

%s labels could not be updated: %w

Error message

%s labels could not be updated: %w

What it means

Thrown by setMetadataVisitor when mergeLabels fails: the generic metadata accessor (k8s.io/apimachinery meta.Accessor) could not read or write labels on the rendered object. This happens when the object passed to the visitor is a runtime.Object that does not expose ObjectMeta labels — most commonly aggregate/list kinds (e.g. kind: List, v1 SecretList) or malformed custom objects. Helm must stamp app.kubernetes.io/managed-by=Helm on every resource, so an object without a usable label set aborts the operation.

Source

Thrown at pkg/action/validate.go:227

// setMetadataVisitor adds release tracking metadata to all resources. If forceOwnership is enabled, existing
// ownership metadata will be overwritten. Otherwise an error will be returned if any resource has an
// existing and conflicting value for the managed by label or Helm release/namespace annotations.
func setMetadataVisitor(releaseName, releaseNamespace string, forceOwnership bool) resource.VisitorFunc {
	return func(info *resource.Info, err error) error {
		if err != nil {
			return err
		}

		if !forceOwnership {
			if err := checkOwnership(info.Object, releaseName, releaseNamespace); err != nil {
				return fmt.Errorf("%s cannot be owned: %w", resourceString(info), err)
			}
		}

		if err := mergeLabels(info.Object, map[string]string{
			appManagedByLabel: appManagedByHelm,
		}); err != nil {
			return fmt.Errorf(
				"%s labels could not be updated: %w",
				resourceString(info), err,
			)
		}

		if err := mergeAnnotations(info.Object, map[string]string{
			helmReleaseNameAnnotation:      releaseName,
			helmReleaseNamespaceAnnotation: releaseNamespace,
		}); err != nil {
			return fmt.Errorf(
				"%s annotations could not be updated: %w",
				resourceString(info), err,
			)
		}

		return nil
	}
}

View on GitHub (pinned to 2a29f1770b)

Solutions

1. Fix the template to emit individual resources instead of a List wrapper — split list items into separate documents
2. Verify every rendered manifest has valid apiVersion, kind and metadata blocks: helm template ./chart | kubectl apply --dry-run=client -f - to validate
3. If using a post-renderer (Kustomize etc.), ensure it preserves metadata and does not emit list kinds
4. For SDK users: confirm the objects added to the ResourceList are standard or unstructured metadata-bearing objects

Example fix

# before: templates/stuff.yaml
apiVersion: v1
kind: List
items:
  - apiVersion: v1
    kind: ConfigMap
    metadata:
      name: cm-one

# after: templates/stuff.yaml
documents emitted individually
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: cm-one

// Before invoking the action, ensure every rendered manifest carries settable metadata:
func metadataSafe(obj runtime.Object) bool {
    _, err := meta.Accessor(obj)
    return err == nil
}
// reject or rewrite objects failing metadataSafe() before building the ResourceList

func isListKind(u *unstructured.Unstructured) bool {
    return strings.HasSuffix(u.GetKind(), "List")
}

if err := installAction.RunWithContext(ctx); err != nil {
    if strings.Contains(err.Error(), "labels could not be updated") {
        // inspect rendered manifests for List kinds / missing metadata and fix templates
    }
}

When it happens

Trigger: A chart template renders a kind: List (or other list-type aggregate) as a top-level resource; a CRD-based object whose Go/unstructured representation lacks metadata.labels support; a template producing an object with empty/missing apiVersion or kind that confuses mapping; SDK users feeding non-standard runtime.Objects into the resource list.

Common situations: Templates copied from kubectl output that embed List wrappers; charts written for other templating engines; objects with TypeMeta stripped by faulty post-renderers (e.g. Kustomize misconfiguration); hand-built manifests with indentation errors making metadata unreachable.

Related errors

• %s annotations could not be updated: %w
• %s cannot be owned: %w
• annotation 'helm.sh/resource-policy' within List objects are
• cluster reachability check failed: %w
• user supplied labels contains system reserved label name. Sy

AI-assisted analysis of helm/helm@2a29f1770b (2026-08-15). Data as JSON: /api/errors/cffe7b2181c51740. Report an issue: GitHub.