{"record":{"id":"c87e9c1b14a65642","repo":"kubernetes/kops","slug":"serviceaccount-level-iam-is-not-yet-supported-on-c","errorCode":null,"errorMessage":"ServiceAccount-level IAM is not yet supported on cloud %T","messagePattern":"ServiceAccount-level IAM is not yet supported on cloud %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/subject.go","lineNumber":116,"sourceCode":"\t\treturn &NodeRoleNode{\n\t\t\tenableLifecycleHookPermissions: enableLifecycleHookPermissions,\n\t\t}, nil\n\tcase kops.InstanceGroupRoleBastion:\n\t\treturn &NodeRoleBastion{}, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown instancegroup role %q\", igRole)\n\t}\n}\n\n// AddServiceAccountRole adds the appropriate mounts / env vars to enable a pod to use a service-account role\nfunc AddServiceAccountRole(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {\n\tcloudProvider := context.Cluster.GetCloudProvider()\n\n\tswitch cloudProvider {\n\tcase kops.CloudProviderAWS:\n\t\treturn addServiceAccountRoleForAWS(context, podSpec, serviceAccountRole)\n\tdefault:\n\t\treturn fmt.Errorf(\"ServiceAccount-level IAM is not yet supported on cloud %T\", cloudProvider)\n\t}\n}\n\nfunc addServiceAccountRoleForAWS(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {\n\troleName, err := context.IAMNameForServiceAccountRole(serviceAccountRole)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tawsRoleARN := \"arn:\" + context.AWSPartition + \":iam::\" + context.AWSAccountID + \":role/\" + roleName\n\ttokenDir := \"/var/run/secrets/amazonaws.com/\" //nolint:gosec // This is the projected token directory path, not a credential.\n\ttokenName := \"token\"\n\n\tvolume := corev1.Volume{\n\t\tName: \"token-amazonaws-com\",\n\t}\n\n\tmode := int32(0o644)","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/subject.go#L98-L134","documentation":"AddServiceAccountRole was called for a cloud provider with no service-account-level IAM integration implemented (currently only AWS has one); the cloud type is printed via %T, and the pod-spec mutation cannot proceed.","triggerScenarios":"Thrown at pkg/model/iam/subject.go:116 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use node-level IAM for the unsupported cloud provider","Remove the serviceAccountRole configuration from the pod spec on this cloud","Track upstream support for the provider"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}