kubernetes/kops · error

cannot determine role for instance group: %v

Error message

cannot determine role for instance group: %v

What it means

After the nil check, BuildConfig reads ig.Spec.Role to branch control-plane vs node behavior. An empty role means the InstanceGroup spec is incomplete; the role cannot be determined so config building aborts with the group's name in the message.

Source

Thrown at pkg/nodemodel/nodeupconfigbuilder.go:185

		etcdManifests:              etcdManifests,
		images:                     images,
		encryptionConfigSecretHash: encryptionConfigSecretHash,
	}

	return &configBuilder, nil
}

// BuildConfig returns the NodeUp config and auxiliary config.
func (n *nodeUpConfigBuilder) BuildConfig(ig *kops.InstanceGroup, wellKnownAddresses model.WellKnownAddresses, keysets map[string]*fi.Keyset) (*nodeup.Config, *nodeup.BootConfig, error) {
	cluster := n.cluster

	if ig == nil {
		return nil, nil, fmt.Errorf("instanceGroup cannot be nil")
	}

	role := ig.Spec.Role
	if role == "" {
		return nil, nil, fmt.Errorf("cannot determine role for instance group: %v", ig.ObjectMeta.Name)
	}

	isMaster := role.HasControlPlane()
	hasAPIServer := isMaster || role.HasAPIServer()

	config, bootConfig := nodeup.NewConfig(cluster, ig)

	igModel, err := kopsmodel.ForInstanceGroup(cluster, ig)
	if err != nil {
		return nil, nil, fmt.Errorf("building instance group model: %w", err)
	}

	if !hasAPIServer && n.assetBuilder.KubeletSupportedVersion != "" {
		// Set kubernetes version to avoid spurious rolling-update
		config.KubernetesVersion = n.assetBuilder.KubeletSupportedVersion

		// TODO: Rename KubernetesVersion to ControlPlaneVersion

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set ig.Spec.Role (ControlPlane/Master, Node, Bastion) on the instance group before building config
2. Recreate the instance group via 'kops create ig' so defaults are applied
3. Validate the cluster spec (kops validate / kops replace -f) to catch empty roles early

Example fix

// before
metadata:
  name: nodes
spec: {} // role missing
// after
metadata:
  name: nodes
spec:
  role: Node

if ig == nil || ig.Spec.Role == "" {
    return fmt.Errorf("instance group %v missing spec.role", ig.ObjectMeta.Name)
}

func roleSet(ig *kops.InstanceGroup) bool {
    return ig != nil && ig.Spec.Role != ""
}

When it happens

Trigger: An InstanceGroup with spec.role absent/empty is passed to BuildConfig during nodeup config generation.

Common situations: Hand-edited or partially migrated InstanceGroup manifests missing role; cluster created by tooling that omitted the field; schema drift between kOps versions.

Related errors

• unhandled instanceGroup role %q
• instanceGroup cannot be nil
• building instance group model: %w
• did not find owner for node %q
• invalid InstanceGroup name: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d53e5da99da39af6. Report an issue: GitHub.