kubernetes/kops · error

failed to apply the manifest: %w

Error message

failed to apply the manifest: %w

What it means

KubectlApplier.Apply writes the addon manifest to a temp file and runs `kubectl apply --server-side --force-conflicts` three times (apply, replace, final apply). This error is returned by the final apply, which kOps treats as authoritative: if it fails, the addon was not converged as expected. The underlying kubectl stderr is wrapped via %w.

Source

Thrown at channels/pkg/channels/kubectlapplier.go:72

		if err != nil {
			klog.Errorf("failed to apply the manifest: %v", err)
		}

	}

	// Replace will force ownership on all fields to kops. But on some k8s versions, this will fail on e.g trying to set clusterIP to "".
	{
		_, err := execKubectl(ctx, "replace", "-f", localManifestFile, "--field-manager=kops")
		if err != nil {
			klog.Errorf("failed to replace manifest: %v", err)
		}
	}

	// Do a final replace to ensure resources are correctly apply. This should always succeed if the addon is updated as expected.
	{
		_, err := execKubectl(ctx, "apply", "-f", localManifestFile, "--server-side", "--force-conflicts", "--field-manager=kops")
		if err != nil {
			return fmt.Errorf("failed to apply the manifest: %w", err)
		}
	}

	return nil
}

func execKubectl(ctx context.Context, args ...string) (string, error) {
	kubectlPath := "kubectl" // Assume in PATH
	cmd := exec.CommandContext(ctx, kubectlPath, args...)
	env := os.Environ()
	cmd.Env = env

	human := strings.Join(cmd.Args, " ")
	klog.V(2).Infof("Running command: %s", human)
	output, err := cmd.CombinedOutput()
	if err != nil {
		klog.Infof("error running %s", human)
		klog.Info(string(output))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kubectl apply -f manifest.yaml --server-side --force-conflicts --field-manager=kops` manually to see the full kubectl output wrapped in this error
2. Fix the manifest field that the API server rejected (immutable fields, unknown fields, missing CRD)
3. Ensure the referenced CRDs/addons are installed before applying this manifest
4. Verify kubectl is in PATH and the current kubeconfig context points at the target cluster with sufficient RBAC
5. Upgrade kubectl to a version matching the cluster if --server-side flags are unsupported

Example fix

// before
apiVersion: v1
kind: Service
spec:
  clusterIP: 10.0.0.5  # changing immutable clusterIP makes apply fail
// after
apiVersion: v1
kind: Service
spec:
  # omit clusterIP so server-side apply does not fight the API server
  ports:
  - port: 80

// Go: pre-flight before calling Apply
if _, err := exec.LookPath("kubectl"); err != nil {
    return fmt.Errorf("kubectl not in PATH: %w", err)
}
if err := clientset.Discovery().ServerVersion(); err != nil {
    return fmt.Errorf("cluster unreachable: %w", err)
}
// dry-run the manifest first
if out, err := exec.Command("kubectl", "apply", "-f", manifestPath, "--dry-run=server").CombinedOutput(); err != nil {
    return fmt.Errorf("manifest rejected: %s", out)
}

if err := applier.Apply(ctx, data); err != nil {
    var outer interface{ Unwrap() error }
    klog.Errorf("addon apply failed: %v", err) // kubectl stderr is logged by klog in execKubectl
    return fmt.Errorf("addon %s apply failed: %w", addonName, err)
}

When it happens

Trigger: The final `kubectl apply -f <manifest> --server-side --force-conflicts --field-manager=kops` exits non-zero — e.g. the manifest is invalid, the API server rejects a field (immutable field conflicts, missing CRDs), RBAC denies access, or kubectl is missing/cannot reach the cluster.

Common situations: Addon manifests referencing CRDs not yet installed; server-side apply conflicts on fields owned by another manager; immutable fields changed (e.g. Service clusterIP); kubeconfig/context problems; older kubectl without --server-side support.

Related errors

• failed to apply objects: %w
• error running kubectl: %v
• failed to prune objects of kind %s: %w
• failed to marshal object to JSON: %w
• error from apply: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3a3ceab4b50733d6. Report an issue: GitHub.