kubernetes/kops · error

error building service account role tasks: %w

Error message

error building service account role tasks: %w

What it means

After constructing the GenericServiceAccount from ServiceAccountExternalPermissions, kOps calls BuildServiceAccountRoleTasks to create the IAMRole/IAMRolePolicy tasks. Any failure there (e.g. generating the role name, building trust policy, OIDC provider issues) is wrapped as "error building service account role tasks". This is an aggregator error — the root cause is in the wrapped message.

Source

Thrown at pkg/model/awsmodel/iam.go:152

			var p *iam.Policy
			aws := sa.AWS
			if aws.InlinePolicy != "" {
				bp, err := b.buildPolicy(aws.InlinePolicy)
				p = bp
				if err != nil {
					return fmt.Errorf("error inline policy: %w", err)
				}
			}
			serviceAccount := &iam.GenericServiceAccount{
				NamespacedName: types.NamespacedName{
					Name:      sa.Name,
					Namespace: sa.Namespace,
				},
				Policy: p,
			}
			iamRole, err := b.BuildServiceAccountRoleTasks(serviceAccount, c)
			if err != nil {
				return fmt.Errorf("error building service account role tasks: %w", err)
			}
			if len(aws.PolicyARNs) > 0 {
				name := "external-" + fi.ValueOf(iamRole.Name)
				externalPolicies := aws.PolicyARNs
				c.AddTask(&awstasks.IAMRolePolicy{
					Name:             new(name),
					ExternalPolicies: &externalPolicies,
					Managed:          true,
					Role:             iamRole,
					Lifecycle:        b.Lifecycle,
				})
			}
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause (%v) in the error text and fix that specific problem first.
2. Check the ServiceAccountExternalPermissions entry: name/namespace must be valid DNS labels, and aws (inlinePolicy or policyARNs) must be well-formed.
3. Ensure the cluster's IAM/OIDC (IRSA) configuration is complete and consistent, then re-run `kops update cluster`.

Example fix

// before
serviceAccountExternalPermissions:
- name: "My_Service"
  namespace: default
  aws:
    policyARNs: ["not-an-arn"]
// after
serviceAccountExternalPermissions:
- name: my-service
  namespace: default
  aws:
    policyARNs: ["arn:aws:iam::123456789012:policy/MyPolicy"]

for _, sa := range cluster.Spec.IAM.ServiceAccountExternalPermissions {
	if sa.Name == "" || sa.Namespace == "" {
		return fmt.Errorf("serviceAccountExternalPermissions entry needs name and namespace")
	}
	if sa.AWS == nil || (sa.AWS.InlinePolicy == "" && len(sa.AWS.PolicyARNs) == 0) {
		return fmt.Errorf("entry %s/%s has no aws permissions", sa.Namespace, sa.Name)
	}
}

if err := kopsUpdate(); err != nil {
	if strings.Contains(err.Error(), "error building service account role tasks") {
		log.Printf("wrapped cause: %v", err) // fix the inner error, not the wrapper
	}
	return err
}

When it happens

Trigger: `kops update cluster` when spec.iam.serviceAccountExternalPermissions contains an entry with an invalid name/namespace, or when the underlying role naming/trust-policy construction fails (e.g. missing or misconfigured OIDC/IRSA config for the cluster).

Common situations: Using ServiceAccountExternalPermissions before enabling the IAM/IRSA features the builder requires; service account names with invalid characters; cluster spec lacking the permissions/OIDC settings the builder expects.

Related errors

• failed to add service account for %q: %w
• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3b2adb8f7110db06. Report an issue: GitHub.