<p>I am trying to use ‘kubectl patch’ to provide an annotation to a default service account in a namespace. This is because the JavaScript client does not seem to have a <code>kubectl annotate</code> function. So now I wonder:
Why does the following patch command not work?</p>
<pre class="lang-bash prettyprint-override"><code>kubectl patch sa default -n somenamespace -v8 --type=json -p='[{&quot;op&quot;: &quot;add&quot;, &quot;path&quot;: &quot;annotations/http://eks.amazonaws.com~1role-arn&quot;, &quot;value&quot;: &quot;ueah&quot;}]'

</code></pre>
<p>While the following statement using annotate does work?</p>
<pre class="lang-bash prettyprint-override"><code>
kubectl annotate --overwrite -v8 sa default -n t-werwww2 http://eks.amazonaws.com/role-arn=&quot;ueah&quot;
</code></pre>
<p>What would be the correct <code>kubectl patch</code> command?</p>

Jeroen
<p>@hiroyukik seems to have partially answered your question by pointing out that you have the path wrong and it should be &quot;/metadata/annotations&quot;.</p>
<p>You used the JSON Merge Patch strategy in your comment. I don't think you need to find a JSON Patch alternative as you suggested, as the the Javascript Kubernetes client supports JSON Merge Patch.</p>
<p>My understanding is that you just add a header in the options to set the strategy you want, like so:</p>
<pre class="lang-js prettyprint-override"><code>const options = { &quot;headers&quot;: { &quot;Content-type&quot;: PatchUtils.PATCH_FORMAT_JSON_MERGE_PATCH } }
</code></pre>
<p>See the docs for how to add this to the function call:</p>
<p><a href="https://kubernetes-client.github.io/javascript/classes/corev1api.corev1api-1.html#patchnamespacedserviceaccount" rel="nofollow noreferrer">https://kubernetes-client.github.io/javascript/classes/corev1api.corev1api-1.html#patchnamespacedserviceaccount</a></p>
<p>However, if you do really need to use the JSON Patch strategy, you'll need to check whether the service account has annotations first as that strategy has no way of creating and adding a field in a single operation. See this Github comment for an explanation:</p>
<p><a href="https://github.com/kubernetes/kubernetes/issues/90623#issuecomment-621584160" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/90623#issuecomment-621584160</a></p>
<p>So a complete shell script example using the JSON Patch strategy would look like this:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl get sa default -n somenamespace -o json \
  | jq -e '.metadata | has(&quot;annotations&quot;)' &amp;&amp; \
kubectl patch sa default -n somenamespace --type=json \
    -p='[{&quot;op&quot;: &quot;add&quot;, &quot;path&quot;: &quot;/metadata/annotations/eks.amazonaws.com~1role-arn&quot;, &quot;value&quot;: &quot;ueah&quot;}]' || \
kubectl patch sa default -n somenamespace --type=json \
    -p='[{&quot;op&quot;:&quot;add&quot;,&quot;path&quot;:&quot;/metadata/annotations&quot;,&quot;value&quot;:{}},{&quot;op&quot;:&quot;add&quot;,&quot;path&quot;:&quot;/metadata/annotations/eks.amazonaws.com~1role-arn&quot;,&quot;value&quot;: &quot;ueah&quot;}]'
</code></pre>
