kubernetes/kops · error

error getting role: %v

Error message

error getting role: %v

What it means

During IAMRolePolicy.Find, kops calls GetRolePolicy to fetch the inline policy document. Non-NoSuchEntity errors from the IAM API are wrapped with this (slightly misleading) 'error getting role' message. It indicates the inline policy could not be retrieved, so the desired/actual diff cannot be computed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:105

		actual.Lifecycle = e.Lifecycle
		actual.Role = e.Role
		actual.Managed = true
		actual.ExternalPolicies = &policies

		return &actual, nil
	}

	request := &iam.GetRolePolicyInput{
		RoleName:   e.Role.Name,
		PolicyName: e.Name,
	}

	response, err := cloud.IAM().GetRolePolicy(ctx, request)
	if err != nil {
		if awsup.IsIAMNoSuchEntityException(err) {
			return nil, nil
		}
		return nil, fmt.Errorf("error getting role: %v", err)
	}

	p := response
	actual.Role = &IAMRole{Name: p.RoleName}
	if aws.ToString(e.Role.Name) == aws.ToString(p.RoleName) {
		actual.Role.ID = e.Role.ID
	}
	if p.PolicyDocument != nil {
		// The PolicyDocument is URI encoded (?)
		policy := *p.PolicyDocument
		policy, err = url.QueryUnescape(policy)
		if err != nil {
			return nil, fmt.Errorf("error parsing PolicyDocument for IAMRolePolicy %q: %v", aws.ToString(e.Name), err)
		}

		// Reformat the PolicyDocument by unmarshaling and re-marshaling to JSON.
		// This will make it possible to compare it when using CloudFormation.
		var jsonData interface{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error code for the real cause
2. Grant iam:GetRolePolicy to the credentials kops uses
3. Ensure the task's Role.Name and policy Name are set (nil would produce an invalid request)
4. Retry after transient throttling/network errors

Example fix

// validate task fields before reconciliation
if e.Role == nil || e.Role.Name == nil || e.Name == nil {
  return fmt.Errorf("IAMRolePolicy requires role name and policy name")
}

// pre-check the inline policy is fetchable
_, err := iamClient.GetRolePolicy(ctx, &iam.GetRolePolicyInput{RoleName: aws.String(roleName), PolicyName: aws.String(policyName)})
if err != nil { log.Println(err) }

if err := kopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error getting role") {
    log.Printf("IAM GetRolePolicy failed: %v", err) // inspect underlying AWS error
  }
}

When it happens

Trigger: GetRolePolicy fails with errors other than NoSuchEntityException — e.g. AccessDenied, throttling, malformed request — while finding an IAMRolePolicy with an inline PolicyDocument.

Common situations: Credentials missing iam:GetRolePolicy; IAM API throttling during large cluster reconciliation; e.Role.Name or e.Name nil producing an invalid request; regional endpoint/connectivity issues.

Related errors

• error creating AutoScalingGroup: %s
• error listing EventBridge rules: %v
• error getting role: %v
• error listing IAM role policies: %v
• error listing IAM role policies for %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e7968b329abb339c. Report an issue: GitHub.