{"record":{"id":"990965444bf9c4eb","repo":"kubernetes/kops","slug":"getting-profile-for-ig-s-v","errorCode":null,"errorMessage":"getting profile for ig %s: %v","messagePattern":"getting profile for ig (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/template_functions.go","lineNumber":866,"sourceCode":"\t\t\tServerCertificatePath: path.Join(pkiDir, \"kops-controller.crt\"),\n\t\t\tServerKeyPath:         path.Join(pkiDir, \"kops-controller.key\"),\n\t\t\tCABasePath:            pkiDir,\n\t\t\tSigningCAs:            signingCAs,\n\t\t\tCertNames:             certNames,\n\t\t}\n\n\t\tif featureflag.Metal.Enabled() {\n\t\t\tconfig.Server.PKI = &pkibootstrap.Options{}\n\t\t}\n\n\t\tswitch cluster.GetCloudProvider() {\n\t\tcase kops.CloudProviderAWS:\n\t\t\tnodesRoles := sets.String{}\n\t\t\tfor _, ig := range tf.AllInstanceGroups {\n\t\t\t\tif ig.Spec.Role.HasNode() || ig.Spec.Role.HasAPIServer() {\n\t\t\t\t\tprofile, err := tf.LinkToIAMInstanceProfile(ig)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn \"\", fmt.Errorf(\"getting profile for ig %s: %v\", ig.Name, err)\n\t\t\t\t\t}\n\t\t\t\t\t// The IAM Instance Profile has not been created at this point if it is not specified.\n\t\t\t\t\t// Because the IAM Instance Profile and the IAM Role are created in IAMModelBuilder tasks.\n\t\t\t\t\t// Therefore, the IAM Role associated with IAM Instance Profile is acquired only when it is not specified.\n\t\t\t\t\tif ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {\n\t\t\t\t\t\tc := tf.cloud.(awsup.AWSCloud)\n\t\t\t\t\t\troles, err := awsup.GetRolesInInstanceProfile(c, *profile.Name)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn \"\", fmt.Errorf(\"getting role from profile %s: %v\", *profile.Name, err)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tnodesRoles.Insert(roles...)\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// When the IAM Instance Profile is not specified, IAM Instance Profile is created by kOps.\n\t\t\t\t\t\t// In this case, the IAM Instance Profile name and IAM Role name are same.\n\t\t\t\t\t\t// So there is no problem even if IAM Instance Profile name is inserted as role name in nodesRoles.\n\t\t\t\t\t\tnodesRoles.Insert(*profile.Name)\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":848,"sourceCodeEnd":884,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/template_functions.go#L848-L884","documentation":"Thrown in KopsControllerConfig (AWS branch) when LinkToIAMInstanceProfile fails for an instance group with a node or API-server role. The failure is in resolving/validating the IAM instance profile for that IG — typically a missing IAM profile task, an invalid profile name, or an unset role for the IG.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/template_functions.go:866 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the IG's spec.iam.profile is set to a valid IAM profile or the well-known names kOps manages","Ensure the IAMInstanceProfile tasks were generated before kops-controller config rendering (check for missing dependencies)","On AWS, verify the referenced instance profile exists in the account and the role is attached"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}