{"record":{"id":"0b9dabd07b0754b5","repo":"kubernetes/kops","slug":"unable-to-parse-role-arn-as-it-is-not-set","errorCode":null,"errorMessage":"unable to parse role arn as it is not set","messagePattern":"unable to parse role arn as it is not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/names.go","lineNumber":162,"sourceCode":"\tcase kops.InstanceGroupRoleAPIServer:\n\t\trolename = \"apiservers.\" + b.ClusterName()\n\tcase kops.InstanceGroupRoleBastion:\n\t\trolename = \"bastions.\" + b.ClusterName()\n\tcase kops.InstanceGroupRoleNode:\n\t\trolename = \"nodes.\" + b.ClusterName()\n\n\tdefault:\n\t\tklog.Fatalf(\"unknown InstanceGroup Role: %q\", role)\n\t}\n\treturn truncate.TruncateString(rolename, truncate.TruncateStringOptions{MaxLength: iam.MaxLengthIAMRoleName, AlwaysAddHash: false})\n}\n\nvar roleNamRegExp = regexp.MustCompile(`([^/]+$)`)\n\n// FindCustomAuthNameFromArn parses the name of a instance profile from the arn\nfunc FindCustomAuthNameFromArn(arn string) (string, error) {\n\tif arn == \"\" {\n\t\treturn \"\", fmt.Errorf(\"unable to parse role arn as it is not set\")\n\t}\n\trs := roleNamRegExp.FindStringSubmatch(arn)\n\tif len(rs) >= 2 {\n\t\treturn rs[1], nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"unable to parse role arn %q\", arn)\n}\n\nfunc (b *KopsModelContext) LinkToIAMInstanceProfile(ig *kops.InstanceGroup) (*awstasks.IAMInstanceProfile, error) {\n\tif ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {\n\t\tname, err := FindCustomAuthNameFromArn(fi.ValueOf(ig.Spec.IAM.Profile))\n\t\treturn &awstasks.IAMInstanceProfile{Name: &name}, err\n\t}\n\tname := b.IAMName(ig.Spec.Role)\n\treturn &awstasks.IAMInstanceProfile{Name: &name}, nil\n}\n","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/names.go#L144-L180","documentation":"FindCustomAuthNameFromArn was called with an empty ARN while resolving a custom IAM role/instance-profile name. It is a guard on missing input: the code attempts to extract the resource name after the last '/' of an ARN, and an empty string cannot match.","triggerScenarios":"Thrown at pkg/model/names.go:162 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the IAM role ARN (e.g. via iam.customProfileName or the relevant role spec field) before invoking cluster build","Fall back to a kOps-generated role name when no custom ARN is configured"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}