kubernetes/kops · error

failed to patch object managed-fields for %q: %w

Error message

failed to patch object managed-fields for %q: %w

What it means

After building the managed-fields merge patch, Migrate PATCHes the object with types.MergePatchType. If the API server rejects or cannot perform that patch, the error is wrapped as "failed to patch object managed-fields for %q" with the object name. The migration for that object is aborted; apply-side callers treat this as a hard error.

Source

Thrown at pkg/applylib/applyset/managedfields.go:50

// ManagedFieldsMigrator manages the migration of field managers from client-side managers to the server-side manager.
type ManagedFieldsMigrator struct {
	Client     *UnstructuredClient
	NewManager string
}

// Migrate migrates from client-side field managers to the NewManager (with an Apply operation).
// This is needed to move from client-side apply to server-side apply.
func (m *ManagedFieldsMigrator) Migrate(ctx context.Context, obj *unstructured.Unstructured) error {
	managedFieldPatch, err := m.createManagedFieldPatch(obj)
	if err != nil {
		return fmt.Errorf("failed to create managed-fields patch: %w", err)
	}
	if managedFieldPatch != nil {
		gvk := obj.GroupVersionKind()
		nn := types.NamespacedName{Namespace: obj.GetNamespace(), Name: obj.GetName()}
		_, err := m.Client.Patch(ctx, gvk, nn, types.MergePatchType, managedFieldPatch, metav1.PatchOptions{})
		if err != nil {
			return fmt.Errorf("failed to patch object managed-fields for %q: %w", obj.GetName(), err)
		}
	}
	return nil
}

// createManagedFieldPatch constructs a patch to combine managed fields.
// It returns nil if no patch is needed.
func (m *ManagedFieldsMigrator) createManagedFieldPatch(currentObject *unstructured.Unstructured) ([]byte, error) {
	if currentObject == nil {
		return nil, nil
	}
	needPatch := false
	fixedManagedFields := []metav1.ManagedFieldsEntry{}
	for _, managedField := range currentObject.GetManagedFields() {
		fixedManagedField := managedField.DeepCopy()
		if managedField.Manager == "kubectl-edit" || managedField.Manager == "kubectl-client-side-apply" {
			needPatch = true
			fixedManagedField.Manager = m.NewManager

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check RBAC: grant patch/update on the target resource to the identity used by the migrator.
2. Re-run the migration after the object settles — conflicts from concurrent modification are transient.
3. Verify the object exists and its GVK resolves on the cluster before migrating (see error 769 for mapping failures).

Example fix

# before
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
# after
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "watch", "patch", "update"]

// ensure patch RBAC before migrating
err := authClient.SelfSubjectAccessReviews.Create(ctx, &authorizationv1.SelfSubjectAccessReview{
    Spec: authorizationv1.SelfSubjectAccessReviewSpec{
        ResourceAttributes: &authorizationv1.ResourceAttributes{Verb: "patch", Resource: resource},
    },
})

if err := migrator.Migrate(ctx, obj); err != nil {
    if apierrors.IsConflict(err) || apierrors.IsNotFound(err) {
        time.Sleep(backoff)
        return migrator.Migrate(ctx, obj) // object settled; retry
    }
    return err
}

When it happens

Trigger: The MergePatchType PATCH to update metadata.managedFields fails: RBAC denial (patch permission missing on the resource), object changed/deleted concurrently (conflict), resource doesn't exist yet, or the API server rejects the merge patch payload.

Common situations: Running migration with a service account lacking patch rights; object deleted by a controller mid-migration; applying migration during a rolling update when objects are being recreated.

Related errors

• failed to create managed-fields patch: %w
• failed to marsal %q into json: %w
• no managed fields supplied
• cannot merge ManagedFieldsEntry apiVersion %q with apiVersio
• error patching needs-update label: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/73bfa84e106ea804. Report an issue: GitHub.