{"record":{"id":"117f625d9ee4bba5","repo":"kubernetes/kops","slug":"error-rendering-rolepolicyattachment-v","errorCode":null,"errorMessage":"error rendering RolePolicyAttachment: %v","messagePattern":"error rendering RolePolicyAttachment: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":329,"sourceCode":"}\n\nfunc (_ *IAMRolePolicy) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRolePolicy) error {\n\tif e.ExternalPolicies != nil && len(*e.ExternalPolicies) > 0 {\n\t\tfor _, policy := range *e.ExternalPolicies {\n\t\t\t// create a hash of the arn\n\t\t\th := fnv.New32a()\n\t\t\th.Write([]byte(policy))\n\n\t\t\tname := fmt.Sprintf(\"%s-%d\", *e.Name, h.Sum32())\n\n\t\t\ttf := &terraformIAMRolePolicy{\n\t\t\t\tRole:      e.Role.TerraformLink(),\n\t\t\t\tPolicyArn: s(policy),\n\t\t\t}\n\n\t\t\terr := t.RenderResource(\"aws_iam_role_policy_attachment\", name, tf)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error rendering RolePolicyAttachment: %v\", err)\n\t\t\t}\n\t\t}\n\t}\n\n\tpolicyString, err := e.policyDocumentString()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering PolicyDocument: %v\", err)\n\t}\n\n\tif policyString == \"\" {\n\t\t// A deletion; we simply don't render; terraform will observe the removal\n\t\treturn nil\n\t}\n\n\tpolicy, err := t.AddFileResource(\"aws_iam_role_policy\", *e.Name, \"policy\", e.PolicyDocument, false)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error rendering PolicyDocument: %v\", err)\n\t}","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L311-L347","documentation":"RenderTerraform renders the aws_iam_role_policy_attachment resource via t.RenderResource; this wraps any failure of that rendering step (template/target writing errors in the terraform target). It is not an AWS error — terraform output generation failed for the attachment resource.","triggerScenarios":"t.RenderResource(\"aws_iam_role_policy_attachment\", ...) returns an error, typically from the underlying render/write machinery in the terraform target (I/O error writing tf files, or an internal render failure).","commonSituations":"Outbdir/target directory not writable or full disk; bug or type mismatch in the rendered terraform struct; running kops update --out to an invalid path.","solutions":["Check the wrapped error; if it is I/O related, verify the --out directory exists and is writable.","Re-run kops update --target=terraform after freeing disk space or fixing permissions.","Report a bug to kops if the render fails consistently with a valid target."],"exampleFix":"// before\nkops update cluster --target=terraform --out=/read-only/path\n// after\nkops update cluster --target=terraform --out=/writable/outdir","handlingStrategy":"try-catch","validationCode":"if err := os.MkdirAll(outDir, 0o755); err != nil { return err }\nif err := writable(outDir); err != nil { return fmt.Errorf(\"out dir not writable: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := runKopsUpdate(); err != nil {\n  if strings.Contains(err.Error(), \"error rendering RolePolicyAttachment\") {\n    klog.Errorf(\"terraform render failed: %v\", err)\n  }\n  return err\n}","preventionTips":["Ensure --out points to a writable path with free disk space.","Run terraform-target generation in CI before any apply to catch render bugs early.","Pin a known-good kops version; render failures at this point are usually internal bugs or FS issues."],"tags":["terraform","render","kops-update"],"backgroundTag":"terraform-render-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}