kubernetes/kops · error

failed to apply objects: %w

Error message

failed to apply objects: %w

What it means

After filtering objects, ClientApplier.Apply delegates to an applyset (SetDesiredObjects + ApplyOnce) that applies each object server-side. If any step of ApplyOnce returns an error, it is wrapped as 'failed to apply objects'. This indicates the apply operation itself failed — API errors, RBAC, invalid objects rejected by the server — rather than a parse or health problem.

Source

Thrown at channels/pkg/channels/clientapplier.go:74

		RESTMapper:   p.RESTMapper,
		Client:       p.Client,
		PatchOptions: patchOptions,
	})
	if err != nil {
		return err
	}

	var applyableObjects []applyset.ApplyableObject
	for _, object := range objects {
		applyableObjects = append(applyableObjects, object)
	}
	if err := s.SetDesiredObjects(applyableObjects); err != nil {
		return err
	}

	results, err := s.ApplyOnce(ctx)
	if err != nil {
		return fmt.Errorf("failed to apply objects: %w", err)
	}

	// TODO: Implement pruning

	if !results.AllApplied() {
		return fmt.Errorf("not all objects were applied")
	}

	// TODO: Check object health status
	if !results.AllHealthy() {
		return fmt.Errorf("not all objects were healthy")
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error for the specific object/field rejected by the API server.
2. Ensure CRDs in the manifest are applied and Established before dependent objects.
3. Grant the identity RBAC for all resources in the manifest.
4. Retry transient failures (timeouts, 5xx, conflicts).
5. Run kubectl apply --server-side --field-manager=kops -f manifest.yaml to reproduce outside the library.

Example fix

// before
err := applier.Apply(ctx, manifest) // fails: CRD not established
// after
ensureCRDsFirst(ctx, client, manifest) // apply CRD objects and wait for Established
err := applier.Apply(ctx, manifest)

// pre-check RBAC for a representative resource
ssar, _ := k8sClient.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, &authv1.SelfSubjectAccessReview{
    Spec: authv1.SelfSubjectAccessReviewSpec{ResourceAttributes: &authv1.ResourceAttributes{
        Verb: "patch", Group: "apps", Resource: "deployments",
    }},
}, metav1.CreateOptions{})
_ = ssar.Status.Allowed

func isApplyFailure(err error) bool {
    return strings.Contains(err.Error(), "failed to apply objects")
}

if err := applier.Apply(ctx, manifest); err != nil {
    if isApplyFailure(err) {
        return retry.OnError(retry.DefaultBackoff, func(e error) bool {
            return apierrors.IsTimeout(e) || apierrors.IsServerTimeout(e) || apierrors.IsConflict(e)
        }, func() error { return applier.Apply(ctx, manifest) })
    }
    return err
}

When it happens

Trigger: ApplyOnce failing due to server-side apply rejection (validation errors, conflicts), RBAC denial on the target resources, API server unavailability, or CRDs not yet registered for objects in the manifest.

Common situations: Applying addon CRs before their CRDs are established; insufficient RBAC for kops to manage the addon resources; server-side apply field-manager conflicts; invalid field values rejected by validation.

Related errors

• failed to marshal object to JSON: %w
• applying kubeconfig secret to cluster: %w
• applying object to cluster: %w
• error adding needs-update label: %v
• error applying annotation to record addon installation: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d3eac37f3dc1554b. Report an issue: GitHub.