Spinnaker "manifest ... failed to apply" (Kubernetes) in CI

By Daniel Zoghalchali·Latchkey

The Deploy (Manifest) stage hands your Kubernetes manifest to Clouddriver, which applies it via the cluster API. "Failed to apply" means kubectl apply was rejected: a schema error, a missing namespace, or the Spinnaker service account lacking RBAC.

What this error means

A Deploy (Manifest) stage fails with "Failed to apply manifest" and a Kubernetes API error such as an admission rejection, "namespaces not found", or a forbidden RBAC message.

Exception ( Deploy (Manifest) )
Failed to apply manifest deployment/app in namespace prod:
error validating data: unknown field "replicaCount" in io.k8s.api.apps.v1.DeploymentSpec

Common causes

The manifest is invalid or has an unknown field

A schema error (wrong field, bad apiVersion) makes the cluster reject the apply.

The Spinnaker account lacks RBAC or the namespace is missing

The Kubernetes account service account cannot create/patch the resource, or the target namespace does not exist.

How to fix it

Validate the manifest before deploy

1. Run the rendered manifest through a dry-run apply locally.
2. Fix schema errors and confirm the target namespace exists.
3. Re-run the pipeline once the manifest validates.

kubectl apply --dry-run=server -f rendered-manifest.yaml

Grant the Spinnaker account the needed RBAC

Ensure the Kubernetes account service account has permission to manage the resource kind in the target namespace.

hal config provider kubernetes account get my-k8s-account
# then bind a Role/ClusterRole to the account service account

How to prevent it

• Validate manifests with server-side dry-run in CI before Spinnaker.
• Keep the Spinnaker account RBAC scoped to what it deploys.
• Ensure target namespaces exist before the deploy stage runs.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation