kubernetes/kops · error

updating %q: %w

Error message

updating %q: %w

What it means

applyMenu calls needUpdate.EnsureUpdated for every addon requiring an update. Failures are wrapped as 'updating %q: %w' (keyed by addon name) and accumulated via multierr, so one failing addon does not prevent attempting the rest.

Source

Thrown at channels/pkg/cmd/apply_channel.go:288

		return nil
	}

	pruner := &channels.Pruner{
		Client:     dynamicClient,
		RESTMapper: restMapper,
	}

	applier := &channels.ClientApplier{
		Client:     dynamicClient,
		RESTMapper: restMapper,
	}

	var merr error

	for _, needUpdate := range needUpdates {
		update, err := needUpdate.EnsureUpdated(ctx, vfsContext, k8sClient, cmClient, pruner, applier, channelVersions[needUpdate.GetNamespace()+":"+needUpdate.Name])
		if err != nil {
			merr = multierr.Append(merr, fmt.Errorf("updating %q: %w", needUpdate.Name, err))
		} else if update != nil {
			fmt.Printf("Updated %q\n", update.Name)
		}
	}

	return merr
}

func getUpdates(ctx context.Context, menu *channels.AddonMenu, k8sClient kubernetes.Interface, cmClient certmanager.Interface, channelVersions map[string]*channels.ChannelVersion) ([]*channels.AddonUpdate, []*channels.Addon, error) {
	var updates []*channels.AddonUpdate
	var needUpdates []*channels.Addon
	for _, addon := range menu.Addons {
		update, err := addon.GetRequiredUpdates(ctx, k8sClient, cmClient, channelVersions[addon.GetNamespace()+":"+addon.Name])
		if err != nil {
			return nil, nil, fmt.Errorf("error checking for required update: %v", err)
		}
		if update != nil {
			updates = append(updates, update)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read which addon names failed and their wrapped causes from the multierr output
2. Check API server events and RBAC for the failing addon's resources
3. Upgrade the cluster if the addon requires newer Kubernetes APIs
4. Re-run `kops apply channel`; the operation is idempotent and retryable

Example fix

// before
kops apply channel https://.../addon.yaml  # updating "dns-controller": ...
// after
kubectl -n kube-system describe addon dns-controller  # inspect state
# fix cause (e.g. RBAC), then re-run
kops apply channel https://.../addon.yaml

allowed, err := k8sClient.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, &authv1.SelfSubjectAccessReview{
	Spec: authv1.SelfSubjectAccessReviewSpec{ResourceAttributes: &authv1.ResourceAttributes{Verb: "create", Resource: "addons"}},
}, metav1.CreateOptions{})
if err != nil || !allowed.Status.Allowed {
	return fmt.Errorf("insufficient RBAC to apply addons")
}

err := retry.OnError(wait.Backoff{Steps: 3, Duration: 2 * time.Second}, isTransient, func() error {
	return needUpdate.EnsureUpdated(ctx, vfsContext, k8sClient, cmClient, pruner, applier, cv)
})
if err != nil {
	log.Printf("addon %q failed after retries: %v", needUpdate.Name, err)
}

When it happens

Trigger: EnsureUpdated fails during `kops apply channel`: API errors creating/updating addon manifests, cert-manager interface errors, VFS fetch failures for addon assets, or applier errors.

Common situations: RBAC denying creation of the addon's resources, manifests rejected by the API server (invalid spec, conflicts), transient network errors, addons requiring a newer Kubernetes version than the cluster.

Related errors

• applying %q: %w
• building menu for %q: %w
• failed to get updates: %w
• error parsing addons: %v
• failed to apply objects: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/81fbc3da4d27916e. Report an issue: GitHub.