tailscale/tailscale · error

unsupported JSON patch operation: %q

Error message

unsupported JSON patch operation: %q

What it means

Raised in JSONPatchResource before any request is sent when a patch entry's Op is not add, remove, or replace. The kube client validates patches locally to avoid sending RFC 6902 operations it has not tested; the caller's patch list is at fault.

Source

Thrown at kube/kubeclient/client.go:298

	return c.kubeAPIRequest(ctx, "PUT", c.resourceURL(s.Name, TypeSecrets, ""), s, nil)
}

// JSONPatch is a JSON patch operation.
// It currently (2024-11-15) only supports "add", "remove" and "replace" operations.
//
// https://tools.ietf.org/html/rfc6902
type JSONPatch struct {
	Op    string `json:"op"`
	Path  string `json:"path"`
	Value any    `json:"value,omitempty"`
}

// JSONPatchResource updates a resource in the Kubernetes API using a JSON patch.
// It currently (2024-11-15) only supports "add", "remove" and "replace" operations.
func (c *client) JSONPatchResource(ctx context.Context, name, typ string, patches []JSONPatch) error {
	for _, p := range patches {
		if p.Op != "remove" && p.Op != "add" && p.Op != "replace" {
			return fmt.Errorf("unsupported JSON patch operation: %q", p.Op)
		}
	}
	return c.kubeAPIRequest(ctx, "PATCH", c.resourceURL(name, typ, ""), patches, nil, setHeader("Content-Type", "application/json-patch+json"))
}

// StrategicMergePatchSecret updates a secret in the Kubernetes API using a
// strategic merge patch.
// If a fieldManager is provided, it will be used to track the patch.
func (c *client) StrategicMergePatchSecret(ctx context.Context, name string, s *kubeapi.Secret, fieldManager string) error {
	surl := c.resourceURL(name, TypeSecrets, "")
	if fieldManager != "" {
		uv := url.Values{
			"fieldManager": {fieldManager},
		}
		surl += "?" + uv.Encode()
	}
	s.Namespace = c.ns
	s.Name = name

View on GitHub (pinned to 6e0912f979)

Solutions

1. The JSON patch contains an unsupported operation; use only supported patch operations (add, remove, replace, etc.) in the request.

When it happens

Trigger: Thrown at kube/kubeclient/client.go:298 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/eb3ed3e5d29cdd02. Report an issue: GitHub.