microsoft/aspire · error · InvalidOperationException

kubectl apply for ClusterIssuer

Error message

kubectl apply for ClusterIssuer '{issuer.Name}' failed with exit code {result.ExitCode}: {errOut}

What it means

ApplyClusterIssuerAsync shells out to 'kubectl apply' to create the ClusterIssuer. If the kubectl process exits with a non-zero exit code, the publisher throws InvalidOperationException including the exit code and kubectl's stderr output so the underlying cluster/API-server error is visible.

Solutions

Read the errOut detail in the message and fix the underlying kubectl failure (auth, connectivity, CRDs).
Run 'kubectl cluster-info' and 'kubectl auth can-i create clusterissuers.cert-manager.io' locally to verify access.
Ensure cert-manager CRDs are installed in the target cluster before publishing.
Confirm the correct kubeconfig context is selected for the target environment.

Defensive patterns

Strategy: retry

Validate before calling

// preflight
kubectl cluster-info && kubectl auth can-i create clusterissuers.cert-manager.io

Try / catch

try { await publishAsync(); }
catch (InvalidOperationException ex) when (ex.Message.StartsWith("kubectl apply for ClusterIssuer")) { logger.LogError(ex, "kubectl apply failed; check kubeconfig/CRDs/RBAC"); throw; }

Prevention

Verify kubeconfig context and credentials before publishing.
Install cert-manager CRDs in the target cluster ahead of time.
Check cluster reachability (VPN/network) before running publish.

When it happens

Trigger: kubectl apply exits non-zero — e.g. kubeconfig missing/invalid, cluster unreachable, RBAC denied, manifest rejected by admission webhooks, or kubectl not able to reach the API server.

Common situations: Expired credentials in kubeconfig, wrong context selected, cert-manager CRDs not installed in the target cluster, or network/VPN preventing cluster access.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/90fa441f16315bbc. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Kubernetes/CertManagerExtensions.cs:482

            {
                Arguments = args.ToString(),
                ThrowOnNonZeroReturnCode = false,
                InheritEnv = true,
                OnOutputData = line => context.Logger.LogDebug("kubectl: {Line}", line),
                OnErrorData = line =>
                {
                    stderr.AppendLine(line);
                    context.Logger.LogDebug("kubectl: {Line}", line);
                }
            });

            await using (disposable.ConfigureAwait(false))
            {
                var result = await resultTask.WaitAsync(context.CancellationToken).ConfigureAwait(false);
                if (result.ExitCode != 0)
                {
                    var errOut = stderr.ToString().Trim();
                    throw new InvalidOperationException(
                        $"kubectl apply for ClusterIssuer '{issuer.Name}' failed with exit code {result.ExitCode}: {errOut}");
                }
            }

            context.Logger.LogInformation("ClusterIssuer '{IssuerName}' applied.", issuer.Name);
        }
        finally
        {
            try { tempDir.Delete(recursive: true); }
            catch (IOException) { /* best-effort cleanup */ }
            catch (UnauthorizedAccessException) { /* best-effort cleanup */ }
        }
    }

    private static async Task DeleteClusterIssuerAsync(
        PipelineStepContext context,
        CertManagerResource certManager,
        CertManagerIssuerResource issuer)

View on GitHub (pinned to 25830f84bd)