kubernetes/kops · error

failed to set object: %w

Error message

failed to set object: %w

What it means

After injecting the IAM service-account role into the parsed PodSpec, addServiceAccountRole writes it back with object.Set(podSpec, "spec","template","spec"). If marshalling/patching the modified PodSpec back into the object fails, this wrapped error is returned — usually a serialization issue rather than a logic problem.

Source

Thrown at pkg/model/components/addonmanifests/remap.go:110

		if err := object.Reparse(podSpec, "spec", "template", "spec"); err != nil {
			return fmt.Errorf("failed to parse spec.template.spec from Deployment: %v", err)
		}
		sa := types.NamespacedName{
			Name:      podSpec.ServiceAccountName,
			Namespace: object.GetNamespace(),
		}
		subject := serviceAccounts[sa]
		if subject == nil {
			continue
		}

		if err := iam.AddServiceAccountRole(&context.IAMModelContext, podSpec, subject); err != nil {
			return err
		}

		if err := object.Set(podSpec, "spec", "template", "spec"); err != nil {
			return fmt.Errorf("failed to set object: %w", err)
		}

	}
	return nil
}

func addLabels(addon *addonsapi.AddonSpec, objects kubemanifest.ObjectList) error {
	for _, object := range objects {
		meta := &metav1.ObjectMeta{}
		err := object.Reparse(meta, "metadata")
		if err != nil {
			return fmt.Errorf("Failed to annotate %T", object)
		}

		if meta.Labels == nil {
			meta.Labels = make(map[string]string)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %w error for the marshal/set failure detail
2. Restore the stock addon manifest matching the kops version
3. Ensure the object is a standard apps/v1 Deployment/DaemonSet with a normal spec.template.spec
4. Upgrade kops if the kubemanifest round-trip bug is fixed upstream

Example fix

// no user-side code fix; replace the non-standard object
// before: kind: Deployment with apiVersion: extensions/v1beta1 remapped in-place
// after: apiVersion: apps/v1 kind: Deployment with spec.template.spec

func canRoundTripPodSpec(obj *kubemanifest.Object) bool {
    var podSpec corev1.PodSpec
    if err := obj.Reparse(&podSpec, "spec", "template", "spec"); err != nil { return false }
    return obj.Set(&podSpec, "spec", "template", "spec") == nil
}

if err := object.Set(podSpec, "spec", "template", "spec"); err != nil {
    return fmt.Errorf("failed to set object: %w", err)
}

When it happens

Trigger: addServiceAccountRole call where iam.AddServiceAccountRole succeeded (volumes/env added for IRSA) but object.Set fails to serialize the PodSpec back into the manifest object (e.g. incompatible structure at that path).

Common situations: Very rare; seen when the manifest object's internal representation diverges from a standard apps/v1 workload structure, or kubemanifest version mismatches; nearly always indicates a corrupt or non-standard manifest.

Related errors

• failed to parse spec.template.spec from Deployment: %v
• expected exactly one container in dns-controller Deployment,
• failed to annotate %q: %w
• failed to add service account for %q: %w
• error remapping manifest %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/eee814abe294bf78. Report an issue: GitHub.