What causes "could not get existing object: %w" in kubernetes/kops?

Check apierrors.IsNotFound(err) and treat it as the create path instead of a hard failure

could not get existing object: %w

Error message

could not get existing object: %w

What it means

Get wraps errors from reading an existing object via the dynamic client. The wrapped error distinguishes the cases: NotFound means the object does not exist yet; anything else (RBAC, network, bad namespace) means the read itself failed.

Source

Thrown at pkg/applylib/applyset/unstructuredclient.go:118

	}

	updated, err := dynamicResource.Update(ctx, obj, opt)
	if err != nil {
		return nil, fmt.Errorf("error updating object: %w", err)
	}
	return updated, nil
}

// Get reads the specified object.
func (c *UnstructuredClient) Get(ctx context.Context, gvk schema.GroupVersionKind, nn types.NamespacedName) (*unstructured.Unstructured, error) {
	dynamicResource, err := c.dynamicResource(ctx, gvk, nn.Namespace)
	if err != nil {
		return nil, err
	}

	obj, err := dynamicResource.Get(ctx, nn.Name, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("could not get existing object: %w", err)
	}

	return obj, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Check apierrors.IsNotFound(err) and treat it as the create path instead of a hard failure
Verify the namespace and GVK are correct (a wrong namespace or kind yields NotFound)
Check RBAC get permission for the resource in the target namespace
If non-NotFound, inspect the wrapped API error (Forbidden, Timeout) and fix connectivity/permissions

Example fix

// before
obj, err := client.Get(ctx, gvk, nn)
if err != nil {
	return err
}
// after
obj, err := client.Get(ctx, gvk, nn)
if err != nil {
	if apierrors.IsNotFound(err) {
		// object does not exist yet: proceed with create/apply
		return nil
	}
	return err
}

Defensive patterns

Strategy: type-guard

Validate before calling

if nn.Namespace == "" && requiresNamespace(gvk) {
	return fmt.Errorf("pre-check: cannot get %s without namespace", gvk.Kind)
}

Type guard

func isNotExist(err error) bool {
	return err != nil && apierrors.IsNotFound(errors.Unwrap(err))
}

Try / catch

obj, err := client.Get(ctx, gvk, nn)
switch {
case err == nil:
	// object exists
	case isNotExist(err):
	// treat as create path
	case apierrors.IsForbidden(errors.Unwrap(err)):
	// check RBAC get permissions
	default:
	return err
}

Prevention

Expect NotFound on first apply and branch to create instead of failing
Verify namespace and GVK spelling when reads unexpectedly 404
Audit RBAC get permissions for the operator's ServiceAccount
Check API server connectivity for non-NotFound wrapped errors

When it happens

Trigger: Calling UnstructuredClient.Get (used by ApplyOnce to fetch current state before applying) when the object is absent, RBAC blocks read, the namespace/scope is wrong, or the API server is unreachable.

Common situations: First apply of a brand-new object where it legitimately does not exist yet (treat NotFound as create, not failure); wrong namespace configured; missing get RBAC for the service account; typo in GVK leading to a nonexistent resource type.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/26b0953d8a55ac7a. Report an issue: GitHub.