kubernetes/kops · error

arn %q does not contain acceptable node role

Error message

arn %q does not contain acceptable node role

What it means

kOps only accepts bootstrap requests from sessions of the configured node roles (a.opt.NodesRoles). After extracting the role name (resource segment 1) from the assumed-role ARN, it checks membership; this error is thrown when the role name does not match any allowed node role.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:290

	}
	// parts[3] is region
	// parts[4] is account
	resource := strings.Split(parts[5], "/")
	if resource[0] != "assumed-role" {
		return nil, fmt.Errorf("arn %q has unrecognized type", arn)
	}
	if len(resource) < 3 {
		return nil, fmt.Errorf("arn %q contains too few slashes", arn)
	}
	found := false
	for _, role := range a.opt.NodesRoles {
		if resource[1] == role {
			found = true
			break
		}
	}
	if !found {
		return nil, fmt.Errorf("arn %q does not contain acceptable node role", arn)
	}

	instanceID := resource[2]
	instances, err := a.ec2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{
		InstanceIds: []string{instanceID},
	})
	if err != nil {
		return nil, fmt.Errorf("describing instance for arn %q", arn)
	}

	if len(instances.Reservations) <= 0 || len(instances.Reservations[0].Instances) <= 0 {
		return nil, fmt.Errorf("missing instance id: %s", instanceID)
	}
	if len(instances.Reservations[0].Instances) > 1 {
		return nil, fmt.Errorf("found multiple instances with instance id: %s", instanceID)
	}

	instance := instances.Reservations[0].Instances[0]

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the instance profile attached to the node is the cluster's nodes role (nodes.<clustername>) and not the masters or bastion role.
2. If intentional, add the role name to a.opt.NodesRoles / the kops cluster spec so it is accepted.
3. Check the cluster name used when creating the instance matches the API server's cluster config (role names embed the cluster name).
4. Replace any manually attached IAM role on the instance with the correct kOps-managed node instance profile.

Example fix

// before: instance profile "masters.cluster.example" reaching the node bootstrap endpoint
// after
aws iam attach-role-policy / instance profile = "nodes.cluster.example"  // or add to NodesRoles:
NodesRoles: []string{"nodes.cluster.example"}

role := strings.Split(strings.Split(arn, ":")[5], "/")[1]
allowed := []string{"nodes." + clusterName}
if !slices.Contains(allowed, role) {
    return fmt.Errorf("role %q is not a node role; attach the correct instance profile", role)
}

func isNodeRoleARN(arn string, nodeRoles []string) bool {
	res := strings.Split(strings.Split(arn, ":")[5], "/")
	return len(res) >= 2 && slices.Contains(nodeRoles, res[1])
}

When it happens

Trigger: A caller assumed a valid role in the correct account (e.g. masters.cluster or bastion role) but the role name is not in NodesRoles — the ARN's role segment fails the whitelist loop in verifyCallerIdentity.

Common situations: A control-plane/master or bastion instance using the node bootstrap API; cluster renamed causing role name mismatch (nodes.newname vs nodes.oldname); custom instance profiles with differently named roles attached to worker instances; shared-AMI images retaining wrong role config.

Related errors

• arn %q has unrecognized type
• arn %q contains too few slashes
• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6646d4af08852946. Report an issue: GitHub.