{"record":{"id":"392971bd743edd59","repo":"kubernetes/kops","slug":"failed-to-add-service-account-for-q-w","errorCode":null,"errorMessage":"failed to add service account for %q: %w","messagePattern":"failed to add service account for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/components/addonmanifests/remap.go","lineNumber":61,"sourceCode":"\t\tobjects, err := kubemanifest.LoadObjectsFrom(manifest)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tif name == \"dns-controller.addons.k8s.io\" {\n\t\t\tif err := dnscontroller.Remap(context, addon, objects); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\n\t\terr = addLabels(addon, objects)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to annotate %q: %w\", name, err)\n\t\t}\n\n\t\terr = addServiceAccountRole(context, objects, serviceAccounts)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to add service account for %q: %w\", name, err)\n\t\t}\n\n\t\tb, err := objects.ToYAML()\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tmanifest = b\n\t}\n\n\t{\n\t\tremapped, err := assetBuilder.RemapManifest(manifest)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error remapping manifest %s: %v\", name, err)\n\t\t}\n\t\tmanifest = remapped\n\t}\n\n\treturn manifest, nil","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/components/addonmanifests/remap.go#L43-L79","documentation":"RemapAddonManifest wraps failures from addServiceAccountRole — which rewrites pod specs to attach IAM-bound service accounts (IRSA) — with this error naming the addon. The underlying cause is a failure to reparse spec.template.spec, call iam.AddServiceAccountRole, or write the pod spec back.","triggerScenarios":"RemapAddonManifest with UseServiceAccountExternalPermissions enabled, where any object with an apps/v1 Deployment/DaemonSet template fails Reparse, AddServiceAccountRole, or object.Set — e.g. non-standard pod template structure that cannot round-trip as corev1.PodSpec.","commonSituations":"Custom/patched addon manifests with unusual pod template fields (e.g. unknown fields or unsupported types that break strict reparse); an addon referencing a service account not present in the serviceAccounts map; kops version mismatch with manifest schema.","solutions":["Inspect the wrapped inner error for the exact failing object and step","Restore the stock addon manifest matching the installed kops version","Ensure each workload's spec.template.spec is a valid, standard PodSpec","Check podSpec.ServiceAccountName matches a service account kops knows about for this addon"],"exampleFix":"// before: custom pod template with unsupported field breaks round-trip\nspec:\n  template:\n    spec:\n      customNonstandardField: x\n// after: standard PodSpec only\nspec:\n  template:\n    spec:\n      serviceAccountName: dns-controller","handlingStrategy":"try-catch","validationCode":"// Confirm every workload references a known service account:\nfor _, obj := range objects {\n    if !hasPodSpecTemplate(obj) { continue }\n    podSpec := &corev1.PodSpec{}\n    if err := obj.Reparse(podSpec, \"spec\", \"template\", \"spec\"); err != nil {\n        return fmt.Errorf(\"pre-check reparse failed: %v\", err)\n    }\n    if _, ok := serviceAccounts[types.NamespacedName{Name: podSpec.ServiceAccountName, Namespace: obj.GetNamespace()}]; !ok {\n        log.Printf(\"note: SA %q not managed by kops; it will be skipped\", podSpec.ServiceAccountName)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := addServiceAccountRole(ctx, objects, sas); err != nil {\n    return fmt.Errorf(\"failed to add service account for %q: %w\", name, err)\n}","preventionTips":["Keep pod templates as standard corev1.PodSpec structures","Match addon manifest versions to the kops binary version","Use stock manifests when IAM/IRSA external permissions are enabled"],"tags":["kops","addon","service-account","irsa","iam"],"backgroundTag":"service-account-injection-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}