What causes "incorrect username %s, the username must equal to the member" in kubesphere/kubesphere?

Make the request body's username exactly match the URL path username

incorrect username %s, the username must equal to the member

Error message

incorrect username %s, the username must equal to the member

What it means

NewErrIncorrectUsername builds 'incorrect username %s, the username must equal to the member' — returned by UpdateWorkspaceMember/UpdateClusterMember/UpdateNamespaceMember when the username in the request body does not match the username in the URL path. Membership updates only allow changing the role of the specified member, not renaming/replacing it.

Source

Thrown at pkg/kapis/iam/v1beta1/handler.go:869

		api.HandleBadRequest(response, request, NewErrMemberNotExist(member.Username))
		return
	}

	err = h.am.CreateOrUpdateNamespaceRoleBinding(member.Username, namespace, member.RoleRef)
	if err != nil {
		api.HandleError(response, request, err)
		return
	}

	response.WriteEntity(servererr.None)
}

func NewErrMemberNotExist(username string) error {
	return fmt.Errorf("member %s not exist", username)
}

func NewErrIncorrectUsername(username string) error {
	return fmt.Errorf("incorrect username %s, the username must equal to the member", username)
}

View on GitHub (pinned to 04a29b5c60)

Solutions

Make the request body's username exactly match the URL path username
Fix client code to derive the body username from the same source as the path
To change membership identity, delete the old member and create the new one instead of updating

Example fix

// before
body := `"username": "bob"` // path: members/alice
// after
body := fmt.Sprintf(`"username": %q`, usernameFromPath)

Defensive patterns

Strategy: validation

Validate before calling

if body.Username != pathUsername {
  return fmt.Errorf("body username %q must equal path member %q", body.Username, pathUsername)
}

Try / catch

if err != nil && strings.Contains(err.Error(), "incorrect username") {
  return ErrUsernameMismatch
}

Prevention

Derive request body username from the same variable as the URL path
Never attempt to swap members via update; delete+create instead
Write client tests asserting body/path equality
Avoid copying request templates with hardcoded usernames

When it happens

Trigger: PUT/PATCH of a workspace/cluster/namespace member where body.username != path username, e.g. path .../members/alice but body {"username":"bob","roleAnnotation":...}.

Common situations: Client code building the body from a different variable than the path param; bulk-update loops sending the wrong payload; copied request templates with a stale username; attempts to repurpose the update endpoint to swap members.

Related errors

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/db66bdcd1a09979a. Report an issue: GitHub.