{"record":{"id":"3b2adb8f7110db06","repo":"kubernetes/kops","slug":"error-building-service-account-role-tasks-w","errorCode":null,"errorMessage":"error building service account role tasks: %w","messagePattern":"error building service account role tasks: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/iam.go","lineNumber":152,"sourceCode":"\t\t\tvar p *iam.Policy\n\t\t\taws := sa.AWS\n\t\t\tif aws.InlinePolicy != \"\" {\n\t\t\t\tbp, err := b.buildPolicy(aws.InlinePolicy)\n\t\t\t\tp = bp\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error inline policy: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tserviceAccount := &iam.GenericServiceAccount{\n\t\t\t\tNamespacedName: types.NamespacedName{\n\t\t\t\t\tName:      sa.Name,\n\t\t\t\t\tNamespace: sa.Namespace,\n\t\t\t\t},\n\t\t\t\tPolicy: p,\n\t\t\t}\n\t\t\tiamRole, err := b.BuildServiceAccountRoleTasks(serviceAccount, c)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error building service account role tasks: %w\", err)\n\t\t\t}\n\t\t\tif len(aws.PolicyARNs) > 0 {\n\t\t\t\tname := \"external-\" + fi.ValueOf(iamRole.Name)\n\t\t\t\texternalPolicies := aws.PolicyARNs\n\t\t\t\tc.AddTask(&awstasks.IAMRolePolicy{\n\t\t\t\t\tName:             new(name),\n\t\t\t\t\tExternalPolicies: &externalPolicies,\n\t\t\t\t\tManaged:          true,\n\t\t\t\t\tRole:             iamRole,\n\t\t\t\t\tLifecycle:        b.Lifecycle,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/iam.go#L134-L170","documentation":"After constructing the GenericServiceAccount from ServiceAccountExternalPermissions, kOps calls BuildServiceAccountRoleTasks to create the IAMRole/IAMRolePolicy tasks. Any failure there (e.g. generating the role name, building trust policy, OIDC provider issues) is wrapped as \"error building service account role tasks\". This is an aggregator error — the root cause is in the wrapped message.","triggerScenarios":"`kops update cluster` when spec.iam.serviceAccountExternalPermissions contains an entry with an invalid name/namespace, or when the underlying role naming/trust-policy construction fails (e.g. missing or misconfigured OIDC/IRSA config for the cluster).","commonSituations":"Using ServiceAccountExternalPermissions before enabling the IAM/IRSA features the builder requires; service account names with invalid characters; cluster spec lacking the permissions/OIDC settings the builder expects.","solutions":["Read the wrapped cause (%v) in the error text and fix that specific problem first.","Check the ServiceAccountExternalPermissions entry: name/namespace must be valid DNS labels, and aws (inlinePolicy or policyARNs) must be well-formed.","Ensure the cluster's IAM/OIDC (IRSA) configuration is complete and consistent, then re-run `kops update cluster`."],"exampleFix":"// before\nserviceAccountExternalPermissions:\n- name: \"My_Service\"\n  namespace: default\n  aws:\n    policyARNs: [\"not-an-arn\"]\n// after\nserviceAccountExternalPermissions:\n- name: my-service\n  namespace: default\n  aws:\n    policyARNs: [\"arn:aws:iam::123456789012:policy/MyPolicy\"]","handlingStrategy":"try-catch","validationCode":"for _, sa := range cluster.Spec.IAM.ServiceAccountExternalPermissions {\n\tif sa.Name == \"\" || sa.Namespace == \"\" {\n\t\treturn fmt.Errorf(\"serviceAccountExternalPermissions entry needs name and namespace\")\n\t}\n\tif sa.AWS == nil || (sa.AWS.InlinePolicy == \"\" && len(sa.AWS.PolicyARNs) == 0) {\n\t\treturn fmt.Errorf(\"entry %s/%s has no aws permissions\", sa.Namespace, sa.Name)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n\tif strings.Contains(err.Error(), \"error building service account role tasks\") {\n\t\tlog.Printf(\"wrapped cause: %v\", err) // fix the inner error, not the wrapper\n\t}\n\treturn err\n}","preventionTips":["Always read the wrapped cause of aggregator errors before changing config.","Validate service account names/namespaces are DNS-label safe.","Confirm IRSA/OIDC prerequisites are configured before adding ServiceAccountExternalPermissions."],"tags":["aws","iam","service-account","irsa"],"backgroundTag":"iam-role-build-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}