{"record":{"id":"27fa3774c7e4a81e","repo":"kubernetes/kops","slug":"spotinst-failed-to-create-ocean-v","errorCode":null,"errorMessage":"spotinst: failed to create ocean: %v","messagePattern":"spotinst: failed to create ocean: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/spotinsttasks/ocean.go","lineNumber":647,"sourceCode":"\t\t_, err = cloud.Spotinst().Ocean().Create(context.Background(), oc)\n\t\tif err == nil {\n\t\t\tbreak\n\t\t}\n\n\t\tif errs, ok := err.(client.Errors); ok {\n\t\t\tfor _, err := range errs {\n\t\t\t\tif strings.Contains(err.Message, \"Invalid IAM Instance Profile name\") {\n\t\t\t\t\tif attempt > maxAttempts {\n\t\t\t\t\t\treturn fmt.Errorf(\"IAM instance profile not yet created/propagated (original error: %v)\", err)\n\t\t\t\t\t}\n\n\t\t\t\t\tklog.V(4).Infof(\"Got an error indicating that the IAM instance profile %q is not ready %q\", fi.ValueOf(e.IAMInstanceProfile.Name), err)\n\t\t\t\t\tklog.Infof(\"Waiting for IAM instance profile %q to be ready\", fi.ValueOf(e.IAMInstanceProfile.Name))\n\t\t\t\t\tgoto readyLoop\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn fmt.Errorf(\"spotinst: failed to create ocean: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *Ocean) update(cloud awsup.AWSCloud, a, e, changes *Ocean) error {\n\tklog.V(2).Infof(\"Updating Ocean %q\", *e.Name)\n\n\tactual, err := e.find(cloud.Spotinst().Ocean())\n\tif err != nil {\n\t\tklog.Errorf(\"Unable to resolve Ocean %q, error: %s\", *e.Name, err)\n\t\treturn err\n\t}\n\n\tvar changed bool\n\tocean := new(aws.Cluster)\n\tocean.SetId(actual.ID)","sourceCodeStart":629,"sourceCodeEnd":665,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/spotinsttasks/ocean.go#L629-L665","documentation":"kOps failed while asking the Spotinst API to create a new Ocean cluster resource during `kops update cluster`. The underlying Spotinst SDK/HTTP error is wrapped with `%v`, so the real cause (auth, validation, API outage, IAM profile propagation) is in the wrapped message. It is thrown from the create path of `createOrUpdate` after retry handling for a not-ready IAM instance profile has been exhausted.","triggerScenarios":"Calling `kops update cluster` on a Spotinst-backed cluster where the Ocean does not yet exist and `cloud.Spotinst().Ocean().Create(...)` returns an error: invalid Spotinst credentials/token, invalid Ocean spec fields (e.g. image, instance types, region), the IAM instance profile not becoming ready within the readyLoop retries, or the Spotinst API being unreachable/rate-limited.","commonSituations":"Misconfigured SPOTINST_TOKEN/SPOTINST_ACCOUNT environment values; first cluster creation in a new account; newly created IAM instance profile not yet propagated in AWS so Spotinst rejects it; quota or region-not-enabled issues on the Spotinst account.","solutions":["Read the wrapped `%v` message in the error output; it names the actual Spotinst API failure (auth, validation, rate limit).","Verify SPOTINST_TOKEN and SPOTINST_ACCOUNT (or credentials file) are correct and the token has cluster-write permissions.","Re-run `kops update cluster` after a short delay if the cause was an IAM instance profile not yet ready — creation retries are bounded, so a retry usually succeeds once AWS propagates the profile.","Check the Ocean spec fields in the cluster spec (region, image, instance types) against Spotinst API validation rules for your account."],"exampleFix":"// before: kops update cluster fails with 'spotinst: failed to create ocean: 401 unauthorized'\nexport SPOTINST_TOKEN=stale-token\n// after\nexport SPOTINST_TOKEN=<valid-token>\nexport SPOTINST_ACCOUNT=<act-xxxx>\nkops update cluster --yes","handlingStrategy":"retry","validationCode":"// preflight\nif os.Getenv(\"SPOTINST_TOKEN\") == \"\" || os.Getenv(\"SPOTINST_ACCOUNT\") == \"\" {\n    return fmt.Errorf(\"Spotinst credentials not configured\")\n}\nif err := verifyIAMInstanceProfileReady(profileName); err != nil {\n    return fmt.Errorf(\"IAM instance profile not ready: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"err := runKopsUpdate(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to create ocean\") {\n    // wrapped cause is included; back off and retry for transient/IAM-propagation issues\n    return retryWithBackoff(3, 30*time.Second, runKopsUpdate)\n}\nreturn err","preventionTips":["Ensure the IAM instance profile exists and is propagated before running kOps update.","Validate Spotinst token/account in CI before cluster operations.","Check Spotinst account quotas and region enablement ahead of first create."],"tags":["spotinst","aws","cluster-provisioning","api-error"],"backgroundTag":"spotinst-ocean-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}