{"record":{"id":"ea06ea421813ddb8","repo":"kubernetes/kops","slug":"role-name-length-must-be-equal-to-64-or-less-q","errorCode":null,"errorMessage":"role name length must be equal to 64 or less: %q","messagePattern":"role name length must be equal to 64 or less: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrole.go","lineNumber":137,"sourceCode":"\tactual.Tags = mapIAMTagsToMap(r.Tags)\n\n\tklog.V(2).Infof(\"found matching IAMRole %q\", aws.ToString(actual.ID))\n\te.ID = actual.ID\n\n\t// Avoid spurious changes\n\tactual.ExportWithID = e.ExportWithID\n\tactual.Lifecycle = e.Lifecycle\n\n\treturn actual, nil\n}\n\nfunc (e *IAMRole) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *IAMRole) ShouldCreate(a, e, changes *IAMRole) (bool, error) {\n\tif len(*e.Name) > 64 {\n\t\treturn false, fmt.Errorf(\"role name length must be equal to 64 or less: %q\", *e.Name)\n\t}\n\treturn true, nil\n}\n\nfunc (s *IAMRole) CheckChanges(a, e, changes *IAMRole) error {\n\tif a != nil {\n\t\tif e.Name == nil {\n\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t} else {\n\t\tif changes.Name == nil {\n\t\t\treturn fi.CannotChangeField(\"Name\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (_ *IAMRole) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMRole) error {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrole.go#L119-L155","documentation":"IAM role names are limited to 64 characters. ShouldCreate() validates the desired name before creation and returns this error (with create=false) if it exceeds the limit, aborting the operation rather than hitting a cryptic AWS EntityTooLarge-style failure.","triggerScenarios":"len(*e.Name) > 64: the computed cluster/role name (e.g. masters.<very-long-cluster-name>) exceeds 64 characters at creation time.","commonSituations":"Very long cluster names or DNS domains producing role names like kops-controllers.<long.domain>; company naming conventions prepending long prefixes; older clusters renamed with longer suffixes.","solutions":["Shorten the cluster name (and thus derived role names) to keep role names <= 64 chars","Reduce any prefix in the kops/IAM naming config so the final name fits","Create the cluster with a shorter name and migrate workloads if renaming in place is not possible","Check for duplicated suffixes/prefixes in the spec that inflate the name"],"exampleFix":"// before: cluster name too long\nkops create cluster masters.very-long-production-cluster-name.us-east-1.internal\n// after\nkops create cluster prod.us-east-1.internal","handlingStrategy":"validation","validationCode":"// validate the derived role name length before creation\nname := \"kops-controllers.\" + clusterName\nif len(name) > 64 { return fmt.Errorf(\"role name %q exceeds IAM 64-char limit; shorten cluster name\", name) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep cluster names short enough that derived IAM names fit 64 chars","Compute worst-case derived role names during cluster naming review","Check IAM limits (name 64, path 512) in CI for naming conventions","Avoid stacking long prefixes plus long DNS suffixes"],"tags":["aws","iam","naming","validation","limits"],"backgroundTag":"aws-name-length-limit","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}