{"record":{"id":"d7cbb3961b876bd8","repo":"kubernetes/kops","slug":"ssm-image-parameter-is-required","errorCode":null,"errorMessage":"ssm image parameter is required","messagePattern":"ssm image parameter is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/template_functions_karpenter.go","lineNumber":470,"sourceCode":"\t\tSpec: spec,\n\t}, nil\n}\n\nfunc buildKarpenterAMITerms(image string) ([]karpenterAMITerm, error) {\n\timage = strings.TrimSpace(image)\n\tif image == \"\" {\n\t\treturn nil, fmt.Errorf(\"image is required\")\n\t}\n\tif strings.Contains(image, \"://\") {\n\t\treturn nil, fmt.Errorf(\"image %q must be ami-*, ssm:<parameter>, <name>, or <owner>/<name>\", image)\n\t}\n\tif strings.HasPrefix(image, \"ami-\") {\n\t\treturn []karpenterAMITerm{{ID: image}}, nil\n\t}\n\tif strings.HasPrefix(image, \"ssm:\") {\n\t\tparameter := strings.TrimPrefix(image, \"ssm:\")\n\t\tif parameter == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"ssm image parameter is required\")\n\t\t}\n\t\treturn []karpenterAMITerm{{SSMParameter: parameter}}, nil\n\t}\n\n\ttokens := strings.SplitN(image, \"/\", 2)\n\tif len(tokens) == 1 {\n\t\treturn []karpenterAMITerm{{Name: image, Owner: \"self\"}}, nil\n\t}\n\tif tokens[0] == \"\" || tokens[1] == \"\" {\n\t\treturn nil, fmt.Errorf(\"image %q must be ami-*, ssm:<parameter>, <name>, or <owner>/<name>\", image)\n\t}\n\treturn []karpenterAMITerm{{Owner: awsup.ResolveImageOwnerAlias(tokens[0]), Name: tokens[1]}}, nil\n}\n\nfunc (tf *TemplateFunctions) karpenterAssociatePublicIP(ig *kops.InstanceGroup) (*bool, error) {\n\tsubnets, err := tf.GatherSubnets(ig)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":452,"sourceCodeEnd":488,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/template_functions_karpenter.go#L452-L488","documentation":"When the image uses the ssm: prefix, the parameter name after the prefix must be non-empty. An image spec like 'ssm:' with nothing after it leaves buildKarpenterAMITerms with no SSM parameter and it returns 'ssm image parameter is required'.","triggerScenarios":"Image string starting with 'ssm:' followed by empty text (e.g. 'ssm:' or 'ssm:  ') in the Karpenter instance group image field.","commonSituations":"Environment-variable substitution in the cluster spec resolving to empty (SSM_PARAMETER= left unset); hand-edited yaml truncating the parameter path.","solutions":["Provide the full SSM parameter path, e.g. ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64","Fix the templating/env variable that should supply the parameter name","Verify the SSM parameter exists in the cluster region and is readable","Re-run `kops update cluster`"],"exampleFix":"// before\nimage: ssm:\n// after\nimage: ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64","handlingStrategy":"validation","validationCode":"// ensure ssm: prefix has a parameter\nif strings.HasPrefix(image, \"ssm:\") && strings.TrimSpace(strings.TrimPrefix(image, \"ssm:\")) == \"\" {\n\treturn fmt.Errorf(\"ssm: image requires a parameter path\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"ssm image parameter is required\") {\n\treturn fmt.Errorf(\"provide the SSM parameter path after ssm:\")\n}","preventionTips":["Verify the variable supplying the SSM parameter is non-empty in your templating","Confirm the SSM parameter exists (aws ssm get-parameter) in the cluster region","Commit full parameter paths, not truncated ones, in cluster specs"],"tags":["karpenter","aws","ssm","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}