kubernetes/kops · error

error patching object: %w

Error message

error patching object: %w

What it means

Patch wraps any error returned by the underlying dynamic resource client's Patch call with this message. It is a generic wrapper: the root cause (network, RBAC, conflict, validation, or the scope errors from dynamicResource) is in the wrapped error chain via %w.

Source

Thrown at pkg/applylib/applyset/unstructuredclient.go:89

		return c.client.Resource(gvr), nil

	default:
		// Internal error ... this is panic-level
		return nil, fmt.Errorf("unknown scope for gvk %s: %q", gvk, restMapping.Scope.Name())
	}
}

// Patch performs a Patch operation, used for server-side apply and client-side patch.
func (c *UnstructuredClient) Patch(ctx context.Context, gvk schema.GroupVersionKind, nn types.NamespacedName, patchType types.PatchType, data []byte, opt metav1.PatchOptions) (*unstructured.Unstructured, error) {
	dynamicResource, err := c.dynamicResource(ctx, gvk, nn.Namespace)
	if err != nil {
		return nil, err
	}

	name := nn.Name
	patched, err := dynamicResource.Patch(ctx, name, patchType, data, opt)
	if err != nil {
		return nil, fmt.Errorf("error patching object: %w", err)
	}
	return patched, nil
}

// Update performs an Update operation on the object.  Generally we should prefer server-side-apply.
func (c *UnstructuredClient) Update(ctx context.Context, obj *unstructured.Unstructured, opt metav1.UpdateOptions) (*unstructured.Unstructured, error) {
	gvk := obj.GroupVersionKind()
	dynamicResource, err := c.dynamicResource(ctx, gvk, obj.GetNamespace())
	if err != nil {
		return nil, err
	}

	updated, err := dynamicResource.Update(ctx, obj, opt)
	if err != nil {
		return nil, fmt.Errorf("error updating object: %w", err)
	}
	return updated, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Unwrap with errors.Unwrap / %v of err to read the real API status (use apierrors to inspect StatusCause/Reason)
2. Retry on conflict (409) with backoff and a fresh copy of the object
3. Check RBAC rules for patch permission on the resource in the namespace
4. If server-side apply conflicts persist, inspect managedFields and adopt/steal field ownership

Example fix

// before
patched, err := client.Patch(ctx, gvk, nn, types.ApplyPatchType, data, opts)
// after
patched, err := client.Patch(ctx, gvk, nn, types.ApplyPatchType, data, opts)
if err != nil {
	if apierrors.IsConflict(err) {
		// retry with backoff / re-fetch object
	}
	if apierrors.IsForbidden(err) {
		// check RBAC
	}
	return patched, err
}

if nn.Namespace == "" && requiresNamespace(gvk) {
	return fmt.Errorf("pre-check: namespace required to patch %s", gvk)
}

func isRetryablePatchErr(err error) bool {
	return apierrors.IsConflict(err) || apierrors.IsTimeout(err) || apierrors.IsServerTimeout(err)
}

patched, err := client.Patch(ctx, gvk, nn, patchType, data, opt)
if err != nil {
	switch {
	case apierrors.IsConflict(errors.Unwrap(err)):
		// retry with backoff and fresh resourceVersion
	case apierrors.IsForbidden(errors.Unwrap(err)):
		// check RBAC patch permissions
	default:
		return err
	}
}

When it happens

Trigger: Calling UnstructuredClient.Patch (used for server-side apply and client-side patch) where dynamicResource.Patch fails: API server errors (409 Conflict, 422 Unprocessable, 403 Forbidden), network failures, or an empty-namespace/scope error from building the client.

Common situations: Server-side apply conflicts when field managers changed the object; RBAC denying patch on the resource; patching an object that was deleted concurrently; missing namespace triggering the dynamicResource scope error wrapped here.

Related errors

• error from apply: %w
• error patching needs-update label: %v
• error querying namespace %q: %v
• error building annotation patch: %v
• error applying annotation to namespace: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/35ebdc02d952b621. Report an issue: GitHub.