kubernetes/kops · error

error remapping manifest %s: %v

Error message

error remapping manifest %s: %v

What it means

After labels and service-account injection, RemapAddonManifest passes the manifest bytes to assetBuilder.RemapManifest, which rewrites image references (and possibly mirrors them to the configured asset location). If that rewriting fails, the addon name and the underlying error are returned here.

Source

Thrown at pkg/model/components/addonmanifests/remap.go:74

			return nil, fmt.Errorf("failed to annotate %q: %w", name, err)
		}

		err = addServiceAccountRole(context, objects, serviceAccounts)
		if err != nil {
			return nil, fmt.Errorf("failed to add service account for %q: %w", name, err)
		}

		b, err := objects.ToYAML()
		if err != nil {
			return nil, err
		}
		manifest = b
	}

	{
		remapped, err := assetBuilder.RemapManifest(manifest)
		if err != nil {
			return nil, fmt.Errorf("error remapping manifest %s: %v", name, err)
		}
		manifest = remapped
	}

	return manifest, nil
}

func addServiceAccountRole(context *model.KopsModelContext, objects kubemanifest.ObjectList, serviceAccounts map[types.NamespacedName]iam.Subject) error {
	if !context.UseServiceAccountExternalPermissions() {
		return nil
	}

	for _, object := range objects {
		if !hasPodSpecTemplate(object) {
			continue
		}
		podSpec := &corev1.PodSpec{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v error for the specific image or registry failure
2. Fix the malformed image reference in the addon manifest
3. Verify credentials and connectivity to the mirror registry (docker login / network policy)
4. Disable asset replication (remove --set-cluster-assets / mirroring config) if not needed

Example fix

// before: unreachable mirror configured
KOPS_ASSETS: registry.internal.example/kops
// after: correct reachable registry or empty
KOPS_ASSETS: ""  # or reachable registry with valid credentials

// Validate image references are parseable before remapping:
for _, img := range extractImageReferences(manifest) {
    if _, _, err := dockerRef.Parse(img); err != nil {
        return fmt.Errorf("invalid image reference %q: %v", img, err)
    }
}

remapped, err := assetBuilder.RemapManifest(manifest)
if err != nil {
    // retry transient registry errors before failing
    if isTransientRegistryError(err) { remapped, err = retry(3, func() ([]byte, error) { return assetBuilder.RemapManifest(manifest) }) }
    if err != nil { return nil, fmt.Errorf("error remapping manifest %s: %v", name, err) }
}

When it happens

Trigger: RemapAddonManifest call where AssetBuilder.RemapManifest fails — typically an image reference in the manifest cannot be parsed, or pushing/copying to a private registry (assets image replica) fails.

Common situations: kops configured with --set-cluster-asset / container registry mirroring and the registry is unreachable or credentials are missing; malformed image string in the addon manifest; network egress blocked in air-gapped environments.

Related errors

• assetsLocation.fileRepository must be set to remap asset %v
• expected exactly one container in dns-controller Deployment,
• failed to annotate %q: %w
• failed to add service account for %q: %w
• failed to parse spec.template.spec from Deployment: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/54c029460bd943ae. Report an issue: GitHub.