kubernetes/kops · error

building instance profile for %q: %w

Error message

building instance profile for %q: %w

What it means

Returned by buildKarpenterEC2NodeClass when tf.LinkToIAMInstanceProfile(ig) fails to resolve the IAM instance profile for the instance group. The wrapped cause explains why (profile task missing or not built yet).

Source

Thrown at upup/pkg/fi/cloudup/template_functions_karpenter.go:222

}

func marshalKarpenterResource(ig *kops.InstanceGroup, object interface{}) (string, error) {
	data, err := yaml.Marshal(object)
	if err != nil {
		return "", fmt.Errorf("marshaling Karpenter resource for %q: %w", ig.Name, err)
	}
	return strings.TrimSpace(string(data)), nil
}

func (tf *TemplateFunctions) buildKarpenterEC2NodeClass(ig *kops.InstanceGroup) (*karpenterEC2NodeClass, error) {
	amiSelectorTerms, err := buildKarpenterAMITerms(ig.Spec.Image)
	if err != nil {
		return nil, fmt.Errorf("building amiSelectorTerms for %q: %w", ig.Name, err)
	}

	instanceProfile, err := tf.LinkToIAMInstanceProfile(ig)
	if err != nil {
		return nil, fmt.Errorf("building instance profile for %q: %w", ig.Name, err)
	}

	tags, err := tf.CloudTagsForInstanceGroup(ig)
	if err != nil {
		return nil, fmt.Errorf("building tags for %q: %w", ig.Name, err)
	}
	tags = karpenterEC2NodeClassTags(tags)
	associatePublicIP, err := tf.karpenterAssociatePublicIP(ig)
	if err != nil {
		return nil, err
	}
	userData, err := tf.managedFileContents("nodeupscript-" + ig.Name)
	if err != nil {
		return nil, fmt.Errorf("reading userData for %q: %w", ig.Name, err)
	}
	rootDeviceName, err := tf.karpenterRootDeviceName(ig.Spec.Image)
	if err != nil {
		return nil, fmt.Errorf("resolving root device for %q: %w", ig.Name, err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the instance group has an IAM instance profile configured and its task is built
2. Check the wrapped error from LinkToIAMInstanceProfile for the missing task name
3. Ensure template rendering happens after IAM task construction in the build
4. If using external IAM, confirm profile name is resolvable

Example fix

// before: instance group with no profile
iam:
  allowContainerRegistry: true
// after
iam:
  allowContainerRegistry: true
  instanceProfile: nodes.karpenter  # or let kops generate it

// ensure the instance group defines an IAM instance profile before rendering
if ig.Spec.IAM == nil || (ig.Spec.IAM.InstanceProfile == nil && ig.Spec.IAM.Profile == nil) && !allowGenerated {
	return fmt.Errorf("instance group %q has no IAM instance profile", ig.Name)
}

nc, err := tf.KarpenterEC2NodeClass(ig)
if err != nil {
	return fmt.Errorf("instance profile resolution for %q failed: %w", ig.Name, err)
}

When it happens

Trigger: Rendering a KarpenterEC2NodeClass for an instance group whose IAMInstanceProfile task cannot be linked — profile task absent from the task map or failed construction earlier in cloudup.

Common situations: IAMInstanceProfile not created for the instance group (profile spec removed), custom IAM configuration that skips profile creation, ordering issues where templates render before IAM tasks exist.

Related errors

• error creating IAMInstanceProfileRole: %v
• failed to add service account for %q: %w
• failed to generate AWS IAM Policy: %v
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ebc616c09cf64cd6. Report an issue: GitHub.