{"record":{"id":"16df1e61e517b66f","repo":"kubernetes/kops","slug":"unknown-instancegroup-role-q","errorCode":null,"errorMessage":"unknown instancegroup role %q","messagePattern":"unknown instancegroup role %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/subject.go","lineNumber":104,"sourceCode":"}\n\n// BuildNodeRoleSubject returns a Subject implementation for the specified InstanceGroupRole.\nfunc BuildNodeRoleSubject(igRole kops.InstanceGroupRole, enableLifecycleHookPermissions bool) (Subject, error) {\n\tswitch igRole {\n\tcase kops.InstanceGroupRoleControlPlane:\n\t\treturn &NodeRoleMaster{}, nil\n\tcase kops.InstanceGroupRoleAPIServer:\n\t\treturn &NodeRoleAPIServer{\n\t\t\twarmPool: enableLifecycleHookPermissions,\n\t\t}, nil\n\tcase kops.InstanceGroupRoleNode:\n\t\treturn &NodeRoleNode{\n\t\t\tenableLifecycleHookPermissions: enableLifecycleHookPermissions,\n\t\t}, nil\n\tcase kops.InstanceGroupRoleBastion:\n\t\treturn &NodeRoleBastion{}, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown instancegroup role %q\", igRole)\n\t}\n}\n\n// AddServiceAccountRole adds the appropriate mounts / env vars to enable a pod to use a service-account role\nfunc AddServiceAccountRole(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {\n\tcloudProvider := context.Cluster.GetCloudProvider()\n\n\tswitch cloudProvider {\n\tcase kops.CloudProviderAWS:\n\t\treturn addServiceAccountRoleForAWS(context, podSpec, serviceAccountRole)\n\tdefault:\n\t\treturn fmt.Errorf(\"ServiceAccount-level IAM is not yet supported on cloud %T\", cloudProvider)\n\t}\n}\n\nfunc addServiceAccountRoleForAWS(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {\n\troleName, err := context.IAMNameForServiceAccountRole(serviceAccountRole)\n\tif err != nil {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/subject.go#L86-L122","documentation":"BuildNodeRoleSubject received an instance group role outside the known set (control-plane, api-server, node, bastion); a new or invalid role value reached the IAM builder.","triggerScenarios":"Thrown at pkg/model/iam/subject.go:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the instance group's spec.role is a valid kOps role","Fix the instance group manifest","Report upstream if a legitimately new role is unsupported"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}